[Snort-sigs] Bleeding rules virus and threshold issue

James Lay jlay at ...2844...
Mon Feb 21 16:31:49 EST 2005


LOL...no sweat Frank.  Tried that and still get the naughty message of:

FATAL ERROR: Rule-Threshold-Parse: could not create a threshold object --
only one per sid, sid = 2001578

As this is my home machine I'm not to terribly worried about not have
bleeding-virus.rules loading up, but when I upgrade at work it will be an
issue.  I'm thinking maybe I hosed something when I copied the rules over
maybe...not sure.  I'll keep digging on my end.  Thanks again.

James

-----Original Message-----
From: Frank Knobbe [mailto:frank at ...1978...]
Sent: Monday, February 21, 2005 5:26 PM
To: James Lay
Cc: 'Snort-Sigs (E-mail)
Subject: RE: [Snort-sigs] Bleeding rules virus and threshold issue


On Mon, 2005-02-21 at 18:21 -0600, Frank Knobbe wrote:
> > -rw-r--r--  1 jlay users  2117 Feb 21 14:07 bleeding.rules
> > 
> 
> Yeah, there it is. It's names "bleeding.rules" (my bad, I thought it was
> bleeding-all.rules).
> 
> Just don't include bleeding.rules and you should be in good shape.


Yeah, right... ignore the email.... "Frank would like to recall this
message". 99 lashes for me emailing nonsense like that...

bleeding.rules is not bleeding-all.rules :)

I'm gonna go stand in the corner for a while...

Regards,
Frank





More information about the Snort-sigs mailing list