I would like to propose a new, or possibly alternative active-response
configuration format.
Perhaps it's just me, or my attention span, but I find the levels method
a bit complex -- where I'd prefer a direct approach on this one.
Something like this:
<rule id="1234" frequency="3" action="block_perm">
... other options and specifics here....
</rule>
Where:
block_perm = permanent block
block_temp = temporary timed block
(both of these can be further defined elsewhere)
This basically says:
- This rule triggered
- At least 3 times
- Block it according to the defined state
This could be a separate configuration directive altogether if needed,
so as to not conflict with the existing tree - and could be used for
simple/absolute situations where a tree of levels might not be useful.
Forrest
