Hello Herb, Sunday, July 31, 2005, 4:00:58 PM, you wrote:
HM> 60_whitelist.cf HM> 70_sare_adult.cf HM> 70_sare_bayes_poison_nxm.cf HM> 70_sare_evilnum0.cf HM> 70_sare_evilnum1.cf HM> 70_sare_genlsubj.cf HM> 70_sare_genlsubj0.cf HM> 70_sare_genlsubj1.cf HM> 70_sare_genlsubj2.cf HM> 70_sare_genlsubj3.cf the 70_sare_genlsubj.cf includes all of the next four, so you can get rid of them. HM> 70_sare_genlsubj_arc.cf HM> 70_sare_genlsubj_eng.cf HM> 70_sare_header.cf HM> 70_sare_header0.cf HM> 70_sare_header1.cf HM> 70_sare_header2.cf HM> 70_sare_header3.cf Ditto -- those last four above are duplicated within 70_sare_header.cf HM> 70_sare_header_eng.cf HM> 70_sare_highrisk.cf HM> 70_sare_html.cf HM> 70_sare_html0.cf HM> 70_sare_html1.cf HM> 70_sare_html2.cf HM> 70_sare_html4.cf You don't have 70_sare_html3.cf? html3.cf is more effective than 70_sare_html4.cf HM> 70_sare_html_eng.cf HM> 70_sare_obfu.cf HM> 70_sare_obfu2.cf HM> 70_sare_oem.cf HM> 70_sare_random.cf HM> 70_sare_ratware.cf 70_sare_ratware.cf is empty. You can delete that. HM> 70_sare_specific.cf HM> 70_sare_spoof.cf HM> 70_sare_unsub.cf HM> 70_sare_uri0.cf HM> 70_sare_uri1.cf HM> 70_sare_uri3.cf HM> 70_sare_uri_eng.cf HM> 70_sare_whitelist.cf HM> 70_sare_whitelist_pre30.cf Drop 70_sare_whitelist_pre30.cf -- if 70_sare_whitelist.cf does not error-out for you, then the pre30.cf version is not needed. HM> 70_sc_top200.cf HM> 72_sare_bml_post25x.cf HM> 72_sare_redirect_post3.0.0.cf HM> 88_FVGT_body.cf HM> 88_FVGT_headers.cf HM> 88_FVGT_rawbody.cf HM> 88_FVGT_subject.cf HM> 88_FVGT_uri.cf HM> 999_antidrug.cf antidrug.cf is included within 3.0.x, so there's no need for you to have your own copy. HM> 999_backhair.cf HM> 999_chickenpox.cf HM> 999_mangled.cf HM> 999_weeds_2.cf HM> 99_FVGT_Tripwire.cf HM> 99_FVGT_meta.cf HM> 99_sare_fraud_post25x.cf HM> bogus-virus-warnings.cf HM> random.cf HM> tripwire.cf 99_FVGT_Tripwire.cf and tripwire.cf are the same rules, different names. Use whichever one is more recently updated, and not the other. Bob Menschel
