Next: 4.9 What are all
Up: 4 Rules and Alerts
Previous: 4.7 What are all
The default order that the rules are applied in is alerts first, then pass
rules, then log rules. This ordering ensures that you don't write 50 great
alert rules and then disable them all accidently with an errant pass rule. If
you really want to change this order so that the pass rules are applied first,
use the ``-o'' command line switch, or the ``order'' config directive.
One other thing to keep in mind is that the alert might be generated from a
preprocessor. If that is the case, then no pass rule will help you minimize the
false positives. You will need to use a BPF filter.
|
