On Mon, 03 May 2021 13:17:59 -0400 Bill Cole wrote: > On 3 May 2021, at 11:18, Dave Funk wrote:
> > > > I first crafted a rule: > > header L_MY_HEADER X-My-Header !~ /^UNSET$/ [if-unset: UNSET] > > > > But that would always fire 10 times if there were any instances of > > 'X-My-Header' (even if there was only one). > > I guess that's an artifact of combining the 'if-unset' functionality > with 'tflags multiple' or possibly the negative match test or both. Probably the combination of !~ with tflags multiple. > I'm not sure that it is exactly a bug, because I can't say how SA > "should" deal with that combination of syntax. It could be seen as a bug since without 'maxhits' it would presumably have looped until timeout.
