[Snort-users] Signature DB - Is it being updated?
bmc at ...950...
Mon Mar 4 05:22:05 EST 2002
> I know the sig people are probably very busy, but a signature I queued up,
> wrote a report for and submitted it 2 about hours later on Friday had gone
> back on the unfinished list. I've checked a couple of ofther sigs that have
> been submitted to the list about the same time and they seem to have
> suffered the same fate ....
> If it is not possible to keep up with 'flood' ;-) then would it not be
> sensible to increase the timeout a little before returning them to the
> unfinished list?
We started out doing that, then a jerk queued every signature all at
once. Instead of engineering an overly complex solution to the
problem, I set the queue timeout to 24 hours.
I've bumped up the queue timeout to 72 hours to give the reviewers
a bit more of a buffer.
Again, thanks for submitting information. I really appreciate the
hard work from everyone, as does most every snort user I am sure.
Just FYI, I am working on a method to bundle up the information in a
format that allows for easily redistribution (and printing).
ALL programs are poems, it's just that not all programmers are poets.
-- Jonathan Guthrie in the scary.devil.monastery
More information about the Snort-users