[Snort-users] modifying priority on certain rules
cmcaghon at ...13708...
Wed Feb 22 08:44:01 EST 2006
I think I figured out the problem. I am using Barnyard to log the events
to a database. In the signature table, there was an existing entry for
the sig id, which had the lower priority. Once I removed it from the
signature table, it recreated it with the higher priority.
Has anyone else seen this? If so, do you manually purge/update the entry
in the signature table?
Andreas Östling <andreaso at ...236...> wrote on 02/22/2006 03:31:32 AM:
> On Tuesday 21 February 2006 23:52, Christina McAghon wrote:
> > Thanks for the feedback. However, the problem isn't with how I
> > change the rule, it's the fact that the updated priority isn't taking
> > effect.
> In that case I don't know what the problem is. I do exactly the same
> thing and it works for me :)
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users