On Tue, Oct 11, 2022 at 10:48:26AM +0200, Wolfgang Breyha wrote: > On 11/10/2022 06:59, Henrik K wrote: > > On Tue, Oct 11, 2022 at 12:50:38AM +0200, Wolfgang Breyha wrote: > > > > > > And another quite simple ruleset... > > > meta __SA4TA3_1 6 > > > meta __SA4TA3_2 2 > > > meta __SA4TA3 (__SA4TA3_1 > 2) && (__SA4TA3_2 > 1) > > > doesn't set __SA4TA3. This was working an SA3.4 as well. > > > > Works fine here. > > Really? So why doesn't it work here on RHEL7 and RHEL8? > > Tried again with > meta __SA4TA3_1 6 > meta __SA4TA3_2 2 > meta SA4TA3 (__SA4TA3_1 > 2) && (__SA4TA3_2 > 1) > score SA4TA3 0.1 > > I see > dbg: rules: ran meta rule __SA4TA3_2 ======> got hit (2) > dbg: rules: ran meta rule __SA4TA3_1 ======> got hit (6) > > But no line für SA4TA3 and no report or final score.
Ok I can now reproduce it, only sometimes it hits SA4TA3, sometimes not. Will investigate.
