Sometimes the AWL rule doesn't appear in the list. From looking at the behavior it seems that the rule is only guaranteed to fire if the stored score for the tuple is significantly different than the message score, or if the stored tuple has a very high stored score. But if the stored score and message score are close and the stored tuple does not have a large score, then the rule will not fire.
I assume the above reflects the logic for when to adjust the score, rather than reflecting when the tuple was matched. But the plugin text and code all talk about the rule firing on match, not when corrective scoring occurred. Is this a bug? or should the text be changed? If the current code is intended, I'd like to request a new function call that tells if the tuple exists and the number of times it has been seen -- Eric A. Hall http://www.eric-a-hall.com/ Network Technology Research Group http://www.ntrg.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/
