[Snort-users] modifying priority on certain rules

Christina McAghon cmcaghon at ...13708...
Wed Feb 22 08:44:01 EST 2006


I think I figured out the problem.   I am using Barnyard to log the events 
to a database.  In the signature table, there was an existing entry for 
the sig id, which had the lower priority.  Once I removed it from the 
signature table, it recreated it with the higher priority.

Has anyone else seen this?  If so, do you manually purge/update the entry 
in the signature table?

Thanks,
Christina

Andreas Östling <andreaso at ...236...> wrote on 02/22/2006 03:31:32 AM:

> 
> On Tuesday 21 February 2006 23:52, Christina McAghon wrote:
> > Thanks for the feedback.  However, the problem isn't with how I
> > change the rule, it's the fact that the updated priority isn't taking
> > effect.
> 
> In that case I don't know what the problem is. I do exactly the same 
> thing and it works for me :)
> 
> /Andreas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20060222/255bf327/attachment.html>


More information about the Snort-users mailing list