On Mon, 2007-10-22 at 14:43 -0500, Noel Jones wrote: > At 12:37 PM 10/22/2007, Karsten Bräckelmann wrote: > >When using additional, third party signatures, is there any particular > >order in the signatures? > > No particular order. > > >If both, the official as well as the third > >party sigs match, which one is being reported? > > One or the other will be reported, but not both. The one actually > reported is unpredictable.
Thanks, Noel. That's exactly what I needed, though I did hope for another answer. ;) Guess my logs are just that -- logs. No way to turn them into half-decent stats, unless I rerun per signature set. guenther -- char *t="[EMAIL PROTECTED]"; main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1: (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}} _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html