Well, seems I've been trying to treat the symptoms, and not the cause.
I dont believe /etc/cron.daily/sa_update has been updating my rules. The /var/log/sa-update.log is empty, and has not been updated for a month. And the one closed sa-update.log contains a few errors and likewise wasn't being updated after that.
Also, I think /etc/cron.daily/sa_update is missing a command required for SA 3.2.x according to
http://saupdates.openprotect.com/ :
"For SA 3.2.x, don't forget to add the "--allowplugins" option also to the cron command."
I've made the few changes, manually updated the rules files, and deleted all the scores I've been adding by template except the bayes scoring. We'll see how it goes...
15 Replies
2322 Views