Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort: remove 'last_rule_upd_status' from config

    Scheduled Pinned Locked Moved IDS/IPS
    3 Posts 2 Posters 393 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Z
      ZsZs
      last edited by

      Hi,

      Would it be possible to remove the tag 'last_rule_upd_status' from the package configuration?

      My configuration management gets triggered anytime the download of the rules fails for whatever reason, resulting meaningless records in the configuration management database (to name it: oxidized):

      -			<last_rule_upd_status>failed</last_rule_upd_status>
      +			<last_rule_upd_status>success</last_rule_upd_status>
      

      I had a quick look at the code https://github.com/pfsense/FreeBSD-ports/search?utf8=%E2%9C%93&q=last_rule_upd_status&type= where this variable is used, but I haven't found any reason of storing it in the config.

      Zsolt

      1 Reply Last reply Reply Quote 0
      • bmeeksB
        bmeeks
        last edited by

        @ZsZs:

        Hi,

        Would it be possible to remove the tag 'last_rule_upd_status' from the package configuration?

        My configuration management gets triggered anytime the download of the rules fails for whatever reason, resulting meaningless records in the configuration management database (to name it: oxidized):

        -			<last_rule_upd_status>failed</last_rule_upd_status>
        +			<last_rule_upd_status>success</last_rule_upd_status>
        

        I had a quick look at the code https://github.com/pfsense/FreeBSD-ports/search?utf8=%E2%9C%93&q=last_rule_upd_status&type= where this variable is used, but I haven't found any reason of storing it in the config.

        Zsolt

        I don't recall at the moment what my reasoning was for storing the status in the config.  I believe it may have been to allow the status to be accessed/checked from other code modules.  It would take a few minutes of digging around the jog my memory as to why the value is stored there.

        However, why is it not a good thing to know if your rule updates failed?  They should almost never fail.  On my personal firewall I've seen maybe two per year at most, and most years none.

        Bill

        1 Reply Last reply Reply Quote 0
        • Z
          ZsZs
          last edited by

          Sorry for the late reply, but forgot to click on 'notify'

          why is it not a good thing to know if your rule updates failed?

          It is good to "know" that, but I do not want my config management system catching this "change". It is not a configuration change but a component state change.
          Could it be stored as a global variable accessible to any component?

          The download fails a bit more often than in your system.

          Zsolt

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.