Re: problem with using SARE rules, names longer than 22 chars

[Matt Kettler <mk...@evi-inc.com>]

Jo wrote:
> Matt Kettler wrote:
>> Jo wrote:
>>>
>>> Are these simply problems with the names?     
>> Yes, but it's not really a problem.
>>   
> Thanks for your answer. I only saw after I sent the mail that they were
> only warnings and not errors. I'm a bit less worried now. I thought I
> had a version mismatch or something like that.
>>> Would it help if I shortened those names?
>>>     
>> You could, or you could wait until SARE fixes the rules.
>>   
> Still it seems to strange to arbitrarily limit the length of those names
> to 22 characters.


Yes, but it is NOT a limit. In this case it is just a warning, not an error.

SA will still use the rule, but it is warning you that the rule name is absurdly
long. Long rule names look bad in reports and waste some memory.

However, RDJ will not auto-load any rulesets with any warnings, as a precaution.

It should also be noted that SA 3.1.x increased the warning limit to 50 chars,
so you could upgrade to 3.1.x to eliminate the warning.

Personally, I'd suggest mailing the maintainer of the ruleset and get them to
fix it.