Host Intrusion Detection System Administrator's Guide Release 3.1

Templates and Alerts
UNIX Regular Expressions
Appendix A
129
When you attempt to match the pipe (|), ampersand (&), or comma (,) character in a
regular expression, you must escape those special characters using a backslash (\)
character because these three characters also have special meaning (they are used as
delimiters by the parser of the template property syntax). For example, a path name of
a\|b will have the backslash removed by the template property parser before being
passed as a regular expression to the regular expression parser (for example, as a|b ).
To match a path name that contains one of these three characters. You must escape the
backslash and the special character itself (for example, a\\\|b will be passed to the
regular expression parser as a\|b).