On Tue, Feb 8, 2011 at 3:28 PM, --[ UxBoD ]-- <[email protected]> wrote: >> Doesn't look like you're missing anything. >> > > Why so Dan ? If the frequency on rule 5551 is 6, and there are 31 events that > trigger rule 5503, then I would have expected rule 5551 to have matched 6 > times when in fact it only matched 3 times ? > >
Don't know. I agree, you should probably see 5 matches. It looks like it's setup correctly. It looks like a good test. I'm not in a position to replicate the test, or try it out in a lab environment, at the moment. I can start digging through the source code, but I don't have any ideas about what I'm looking for at the moment. So I basically, and very poorly, said that I didn't think you missed anything (your assumptions were correct). I'll try to look at this more tomorrow.
