On Mon, 2005-11-21 at 12:50 -0500, Theo Van Dinter wrote: > On Mon, Nov 21, 2005 at 09:27:52AM -0800, Justin Mason wrote: > > Either way though, I do see the problem -- could someone open a bug at the > > BZ so we can decide what the "correct" way to do this should be > > and possibly add support for it to the engine? > > Is this something that we need to solve? Rules are designed to look for > things in messages, adding in the ability to say "run but match nothing" > doesn't seem like a useful feature. The known solution to the problem is to > remove the rule. >
i would agree that this should not be a SA issue, except the documentation spells out the usage of meta very clearly as meta SYMBOLIC_TEST_NAME boolean expression and 'meta TEST 0' follows those guidelines. the problem with deleting a rule is if other meta's depended on that rule, your lint would fail and your RDJ would fail to update. the more elegant solution may be to leave the original rule in place and 0 out the score? but, either the code should be changed to support 'meta TEST 0' or the documentation should be updated. dallas
