On Sun, 6 Apr 2014, Helmut Schneider wrote:
Hi,
over the last weeks I constantly run into issues when I cannot get SA
up again because of "broken" rule sets. Today it's
Apr 6 17:06:01.960 [31092] dbg: rules: meta test HEXHASH_WORD has
undefined dependency '__KAM_BODY_LENGTH_LT_512'
Is something wrong in my process or do we have a problem with QA these
days.
Don't get me wrong, I appreciate your work very much.
Thanks, Helmut
What, exactly, do you mean by 'I cannot get SA up again because of "broken" rule
sets. Today it's'
That is effectively a warning, not a fatal error message. That one particular
kind of warning should not stop SA from running.
It means that you've got a meta rule that is a combination of other rules and
one of the other rules is missing.
For example:
meta DIGEST_MULTIPLE RAZOR2_CHECK + DCC_CHECK + PYZOR_CHECK > 1
if you don't have PYZOR installed you'll get a warning for that particular rule
but it just be lacking the input from that particular potential component of
the rule, it will work just fine with the other two components.
Worst case, a given meta rule won't fire at all because it's missing some
necessary component and thus that rule will be effectively disabled but the
whole SA engine should still run.
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
