Alien Vault OSSIM and report_cahnges diff in alerts and emails

alienvault:~# diff -u ~/ossec-single-line.cfg~ /etc/ossim/agent/plugins/ossec-single-line.cfg
--- /root/ossec-single-line.cfg~ 2016-03-03 02:53:13.508871166 +0100
+++ /etc/ossim/agent/plugins/ossec-single-line.cfg 2016-05-07 13:34:02.482491245 +0200
@@ -1421,7 +1421,7 @@
 [0018 - Integrity checksum changed]
 event_type=event
 #precheck="Integrity checksum changed"
-regexp="^AV\s-\sAlert\s-\s\"(?P<date>\d+)\"\s-->\sRID:\s\"(?P<rule_id>((55[012])|(59[456])))\";\sRL:\s\"(?P<rule_level>\d+)\";\sRG:\s\"(?P<rule_group>[^\"]*)\";\sRC:\s\"(?P<rule_comment>[^\"]*)\";\sUSER:\s\"(?P<username>\S+)\";\sSRCIP:\s\"(?P<srcip>[^\"]*)\";\sHOSTNAME:\s\"(?P<agent_name>\([^\)]*\)\s+)?(?:\S+@)?(?P<hostname>(?(agent_name)(?:\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})|(?:\S+)))(?:.*?->\S+)?";\sLOCATION:\s\"(?P<location>[^\"]*)\";\sEVENT:\s\"\[INIT\](?P<log>Integrity checksum changed for: \'(?P<filename>[^\']*)\'(\\[n]Size changed from \'(?P<size_old>\d+?)\' to \'(?P<size_new>\d+?)\')?(\\[n]Old md5sum was: \'(?P<md5_old>\S+?)\'[^\']*\'(?P<md5_new>\S+?)\'[^\']*\'(?P<sha1_old>\S+?)\'[^\']*\'(?P<sha1_new>\S+?)\')?.*)\[END\]\";"
+regexp="^AV\s-\sAlert\s-\s\"(?P<date>\d+)\"\s-->\sRID:\s\"(?P<rule_id>((55[012])|(59[456])))\";\sRL:\s\"(?P<rule_level>\d+)\";\sRG:\s\"(?P<rule_group>[^\"]*)\";\sRC:\s\"(?P<rule_comment>[^\"]*)\";\sUSER:\s\"(?P<username>\S+)\";\sSRCIP:\s\"(?P<srcip>[^\"]*)\";\sHOSTNAME:\s\"(?P<agent_name>\([^\)]*\)\s+)?(?:\S+@)?(?P<hostname>(?(agent_name)(?:\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})|(?:\S+)))(?:.*?->\S+)?";\sLOCATION:\s\"(?P<location>[^\"]*)\";\sEVENT:\s\"\[INIT\](?P<log>Integrity checksum changed for: \'(?P<filename>[^\']*)\'(\\[n]Size changed from \'(?P<size_old>\d+?)\' to \'(?P<size_new>\d+?)\')?(\\[n]Old md5sum was: \'(?P<md5_old>\S+?)\'[^\']*\'(?P<md5_new>\S+?)\'[^\']*\'(?P<sha1_old>\S+?)\'[^\']*\'(?P<sha1_new>\S+?)\')?\\[n]What changed:(?P<what_changed>.*))\[END\]\";"
 date={normalize_date($date)}
 plugin_id={translate($rule_id)}
 plugin_sid={$rule_id}
@@ -1436,7 +1436,7 @@
 userdata5="Old sha1sum: {$sha1_old}"
 userdata6="Old size: {$size_old}"
 userdata7="New size: {$size_new}"
-
+userdata8="What changed: {normalize_strings($what_changed)}"
 
 [0019 - Postfix logs]
 event_type=event

alienvault:~# diff -u ~/ParserUtil.py~ /usr/share/alienvault/ossim-agent/ParserUtil.py
--- /root/ParserUtil.py~ 2016-03-03 10:08:15.369131642 +0100
+++ /usr/share/alienvault/ossim-agent/ParserUtil.py 2016-05-07 13:33:16.926490791 +0200
@@ -965,6 +965,8 @@
 
     return string_translated
 
+def normalize_strings(string):
+    return str(string).replace('\\n',"\n")
 
 class HostResolv():
     HOST_RESOLV_DYNAMIC_CACHE = {}