----- Original Message ----- > On Tue, Feb 8, 2011 at 3:28 PM, --[ UxBoD ]-- <[email protected]> > wrote: > >> Doesn't look like you're missing anything. > >> > > > > Why so Dan ? If the frequency on rule 5551 is 6, and there are 31 > > events that trigger rule 5503, then I would have expected rule > > 5551 to have matched 6 times when in fact it only matched 3 times > > ? > > > > > > Don't know. I agree, you should probably see 5 matches. > > It looks like it's setup correctly. It looks like a good test. I'm > not > in a position to replicate the test, or try it out in a lab > environment, at the moment. I can start digging through the source > code, but I don't have any ideas about what I'm looking for at the > moment. > > So I basically, and very poorly, said that I didn't think you missed > anything (your assumptions were correct). > > I'll try to look at this more tomorrow. >
Hi Dan, No problem I understand where you were coming from :) Should note that this is running server/agent 2.5.1. If my configuration all appears okay then this could potentially be a major bug as active response could very well be triggering/or not as the case may be. If I can help with debugging then please let me know.
