On Thu, 2009-04-02 at 15:34 -0500, Michael Parker wrote:
> On Apr 2, 2009, at 3:17 PM, Karsten Bräckelmann wrote:
> > #reuse NEW_NAME OLD_CRUFT
>
> Actually thats not what you want.
>
> Here is the first question to ask. When you say rename, what do you
> mean exactly?
Actually, really just renaming the rule...
reuse KB_RATWARE_BOUNDARY KB_RATWARE_OUTLOOK_08
> Is this a rule that relies on realtime stats? By that I mean does it
> change over time like blocklists and other network related tests? Or
> is it a meta that evolves a lot, swapping in different predicates over
> time.
Nope, it doesn't change over time, and the meta isn't expected to be
changed much. Currently it is a static, single RE rule -- to be replaced
with a meta of two static REs.
> If not then, you don't want reuse.
I see. So I don't need it... I take it reuse is just necessary for
network tests and stuff like SOUGHT?
That's pretty much what I also tried to ask in my first post. If it is
actually necessary with ruleqa (and some plain, static REs) to inherit
previous hits. Since it is a static rule, and will be evaluated for all
messages in the corpus no matter how old, there just isn't anything to
inherit. The hits over time graph doesn't maintain some history, right?
The rule might be tweaked further, but in that case I want to see hits
over time for the latest version against the entire corpus anyway.
> If it is, then you need to use the new reuse syntax which is basically
> what you found but without the #.
Thanks, Michael. Hope I got it right this time. ;)
--
char *t="\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
