This seems to fix a crash I was seeing.
Trying to reproduce for the logs.
Merge branch 'ossecalert_decoder_crash'
Update copyright date
Merge branch 'master' of https://github.com/ossec/ossec-hids
Merge branch 'master' of https://github.com/ddpbsd/ossec-hids
Merge branch 'apparmor' of https://github.com/ddpbsd/ossec-hids
Add a couple of decoders to decode the ruser field. Based on log samples
from sgtzeno5 at googlemail.
Revert a small change I had made a while back. Let's see if that
crash(maybe? can't remember for sure) returns.
Merge branch 'master' of https://github.com/ossec/ossec-hids into more_pam
Initial tests for pam.

It would be great if runtests supported the decoded fields (maybe
it does?). My pam decoder changes may change some of these (100%
for some subset of log messages). It would be nice to be able to
track those changes with this tool.
Merge branch 'master' of https://github.com/ossec/ossec-hids
Merge pull request #255 from ddpbsd/more_pam

More Pam match and unittests
Merge branch 'master' of https://github.com/ossec/ossec-hids
add some dhclient rules
Remove a debugging comment.
Merge pull request #256 from ddpbsd/more_openbsd

More openbsd rules.