reuse (was: Renaming rules?)

[Karsten Bräckelmann <gu...@rudersport.de>]

On Thu, 2009-04-02 at 21:04 +0200, Karsten Bräckelmann wrote:
> I seem to recall I've seen some tflags(?) or something commands, to have
> a newly named rule inherit previous mass-check results. Is my mind
> playing tricks on me, or does it actually exist?

Lots of grepping the sandboxes later...  It's reuse, isn't it?

Where would I find how to use it exactly? And does it do what I try to
accomplish?  (Yes, more questions. But hey, one of 'em is a result! ;)


> Also, does or doesn't this make any sense for ruleqa?
> 
> Reason is, that I'd like to rename a badly named rule in my sandbox to
> avoid further confusion, but to keep previous mass-check results...

-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Re: reuse (was: Renaming rules?)

[Karsten Bräckelmann <gu...@rudersport.de>]

On Thu, 2009-04-02 at 15:34 -0500, Michael Parker wrote:
> On Apr 2, 2009, at 3:17 PM, Karsten Bräckelmann wrote:

> > #reuse NEW_NAME OLD_CRUFT
> 
> Actually thats not what you want.
> 
> Here is the first question to ask.  When you say rename, what do you  
> mean exactly?

Actually, really just renaming the rule...
reuse KB_RATWARE_BOUNDARY KB_RATWARE_OUTLOOK_08

> Is this a rule that relies on realtime stats? By that I mean does it  
> change over time like blocklists and other network related tests?  Or  
> is it a meta that evolves a lot, swapping in different predicates over  
> time.

Nope, it doesn't change over time, and the meta isn't expected to be
changed much. Currently it is a static, single RE rule -- to be replaced
with a meta of two static REs.

> If not then, you don't want reuse.

I see. So I don't need it... I take it reuse is just necessary for
network tests and stuff like SOUGHT?


That's pretty much what I also tried to ask in my first post. If it is
actually necessary with ruleqa (and some plain, static REs) to inherit
previous hits. Since it is a static rule, and will be evaluated for all
messages in the corpus no matter how old, there just isn't anything to
inherit. The hits over time graph doesn't maintain some history, right?

The rule might be tweaked further, but in that case I want to see hits
over time for the latest version against the entire corpus anyway.


> If it is, then you need to use the new reuse syntax which is basically  
> what you found but without the #.

Thanks, Michael. Hope I got it right this time. ;)


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Re: reuse (was: Renaming rules?)

[Michael Parker <pa...@pobox.com>]

On Apr 2, 2009, at 3:17 PM, Karsten Bräckelmann wrote:

> Please keep in mind you can step into my soliloquy at any time. :)
>
>>> I seem to recall I've seen some tflags(?) or something commands,  
>>> to have
>>> a newly named rule inherit previous mass-check results. Is my mind
>>> playing tricks on me, or does it actually exist?
>>
>> Lots of grepping the sandboxes later...  It's reuse, isn't it?
>
> Found, where I've seen it in the first place. A closed bug... Plus  
> some
> usage pointers. This should do what I want:
>
> #reuse NEW_NAME OLD_CRUFT

Actually thats not what you want.

Here is the first question to ask.  When you say rename, what do you  
mean exactly?

Is this a rule that relies on realtime stats? By that I mean does it  
change over time like blocklists and other network related tests?  Or  
is it a meta that evolves a lot, swapping in different predicates over  
time.

If not then, you don't want reuse.

If it is, then you need to use the new reuse syntax which is basically  
what you found but without the #.

reuse NEW_NAME OLD_NAME

Michael

Re: reuse (was: Renaming rules?)

[Karsten Bräckelmann <gu...@rudersport.de>]

Please keep in mind you can step into my soliloquy at any time. :)

> > I seem to recall I've seen some tflags(?) or something commands, to have
> > a newly named rule inherit previous mass-check results. Is my mind
> > playing tricks on me, or does it actually exist?
> 
> Lots of grepping the sandboxes later...  It's reuse, isn't it?

Found, where I've seen it in the first place. A closed bug... Plus some
usage pointers. This should do what I want:

#reuse NEW_NAME OLD_CRUFT

> > Also, does or doesn't this make any sense for ruleqa?
> > 
> > Reason is, that I'd like to rename a badly named rule in my sandbox to
> > avoid further confusion, but to keep previous mass-check results...

-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}