Both rule89 (a10_session_opened) and rule91 (a10_session_timeout)
failed to compile live: \\" (two backslashes before a quote) is
read by Graylog's rule DSL as an escaped backslash followed by an
unescaped string terminator, not an escaped quote - so the regex()
string literal ended early and everything after it parsed as
garbage ("Unknown function S", "mismatched input '('", etc).
Fix: exactly one backslash before each quote (\") so the DSL treats
it as an escaped quote character, matching the \S/\d/\. occurrences
elsewhere in the same pattern which correctly use two backslashes
(DSL-decodes to one, which is what the regex engine needs). The
other 4 new A10 rules didn't have this issue and already compiled
successfully on the user's first live run.
8 new rules (vendor=a10) wired into Network Equipment Parsing: LSN
TCP/Session/ICMP per-user quota exceeded (critical - real service
impact, drops new connections for that subscriber), BGP-4-MAXPFX
prefix-limit warning, and admin session open/close/timeout/auth-success
(aXAPI and CLI both covered by one pattern each).
Unlike the CSV-report-derived rules, these are built directly from
real captured A10 log output the user provided, so confidence is
higher - closer to the accel-ppp rules' provenance. Multi-entry LSN
lines (several 'ip(count)' pairs in one quota-exceeded message) only
have their first pair extracted into fields; the full list stays in
the raw message.
Not live-verified - the user is bringing the target system up
themselves this time rather than through the test container used
earlier in this branch of work.
