On Tuesday, November 23, 2004, 2:51:10 PM, Bonno wrote: <snip/>
>> BB> Just to let you know. We had a problem after updating to 2.3.2 this <snip/> BB> The version is the same as you say. The rulebase was downloaded last night BB> and later that morning once more but not updated because there were no BB> changes. I verify every downloaded rulebase. Like I wrote, all I did was BB> early thismorng replace the 2.3.1. exe with the 2.3.2 exe. After that the BB> problems started. When I replace the 2.3.2 exe with the 2.3.1 exe all BB> problems disappeared. As I had to attend a seminar this afternoon I did not BB> any time for further testing. I understand. I have no reasonable explanation for your experience. There have been no other reported problems and I have been unable to recreate your conditions. BB> I just once more "installed" the 2.3.2 exe, we'll see what happens. As it is BB> close to 9 PM overhere it should not disrupt any business going on and let BB> me do some testing. Thanks for your efforts. BB> Did you receive the mail I sent along with the "caught" e-mail and the BB> logfiles? Anything that pointed to a special rule? Should I change the BB> logging when this happens so as to provide more information about what might BB> be happening? I did receive these email. I have looked at your logs and I was unable to explain the results. It is as if suddenly all of your black rules were removed ... that is, the sniffer log reports "clean" suddenly on most of your messages. White rules do not seem to be effected. I do not have a theory to explain these conditions. One change you should make is to adjust your Declude configuration so that your message file name is emitted into your message headers. This way when a false positive does occur we can match the message up to the log entries and identify the rule or rules that fired. I have checked our system again and we show no anomalies at this time. Thanks, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
