Snort: remove 'last_rule_upd_status' from config

[ZsZs]

Hi,

Would it be possible to remove the tag 'last_rule_upd_status' from the package configuration?

My configuration management gets triggered anytime the download of the rules fails for whatever reason, resulting meaningless records in the configuration management database (to name it: oxidized):

-			<last_rule_upd_status>failed</last_rule_upd_status>
+			<last_rule_upd_status>success</last_rule_upd_status>

I had a quick look at the code https://github.com/pfsense/FreeBSD-ports/search?utf8=%E2%9C%93&q=last_rule_upd_status&type= where this variable is used, but I haven't found any reason of storing it in the config.

Zsolt

[bmeeks]

@ZsZs:

Hi,

Would it be possible to remove the tag 'last_rule_upd_status' from the package configuration?

My configuration management gets triggered anytime the download of the rules fails for whatever reason, resulting meaningless records in the configuration management database (to name it: oxidized):

-			<last_rule_upd_status>failed</last_rule_upd_status>
+			<last_rule_upd_status>success</last_rule_upd_status>

I had a quick look at the code https://github.com/pfsense/FreeBSD-ports/search?utf8=%E2%9C%93&q=last_rule_upd_status&type= where this variable is used, but I haven't found any reason of storing it in the config.

Zsolt

I don't recall at the moment what my reasoning was for storing the status in the config.  I believe it may have been to allow the status to be accessed/checked from other code modules.  It would take a few minutes of digging around the jog my memory as to why the value is stored there.

However, why is it not a good thing to know if your rule updates failed?  They should almost never fail.  On my personal firewall I've seen maybe two per year at most, and most years none.

Bill

[ZsZs]

Sorry for the late reply, but forgot to click on 'notify'

why is it not a good thing to know if your rule updates failed?

It is good to "know" that, but I do not want my config management system catching this "change". It is not a configuration change but a component state change.
Could it be stored as a global variable accessible to any component?

The download fails a bit more often than in your system.

Zsolt