Hello, --- following up.
Intended to make the original post with a high priority flag.
Also - the rule was removed at approximately 15:10:00 EDT
Hope this helps,
_M
Tuesday, June 17, 2008, 3:35:47 PM, you wrote:
Hello Message,
Rule 1940812 has already been removed from the core rulebase.
-
From: Message Sniffer Community [mailto:[EMAIL PROTECTED] On
Behalf Of Pete McNeil
Sent: Tuesday, June 17, 2008 12:46 PM
To: Message Sniffer Community
Subject: [sniffer] Re: Bad rule alert: 1940812
Hello, --- following up.
Intended to make the original post with a high priority flag.
Also
: Message Sniffer Community [mailto:[EMAIL PROTECTED] On
Behalf Of Pete McNeil
Sent: Tuesday, June 17, 2008 1:31 PM
To: Message Sniffer Community
Subject: [sniffer] Re: Bad rule alert: 1940812
Hello Andrew,
Tuesday, June 17, 2008, 4:21:49 PM, you wrote:
Pete, if we have a significant number
Hello Andrew,
Tuesday, June 17, 2008, 4:41:41 PM, you wrote:
Thanks, Pete.
I had very few actual hits; I have lots of lines that indicate the rule
panic in place, but the number of actual hits is quite small.
How I found my hits:
cd /d C:\MessageSniffer
gawk ($6 == \Final\) ($7 ==
: Tuesday, June 17, 2008 1:47 PM
To: Message Sniffer Community
Subject: [sniffer] Re: Bad rule alert: 1940812
Hello Andrew,
Tuesday, June 17, 2008, 4:41:41 PM, you wrote:
Thanks, Pete.
I had very few actual hits; I have lots of lines that indicate the
rule
panic in place, but the number
Hello Andrew,
Tuesday, June 17, 2008, 5:03:25 PM, you wrote:
Thanks, Pete.
I had four actual false positives on one server, versus 324 unique hits
for the bad rule.
So yes, I'd say that the autopanic feature worked quite well.
It's a little odd to say this under the circumstances, but
