On Tue, Oct 11, 2022 at 01:09:03PM +0200, Wolfgang Breyha wrote: > > And I've still cases were a simple ">" is not evaluated as well... > > I have > meta __META1 (__SUBMETAX + ..... + __SUBMETAXN) > with > dbg: rules: ran meta rule __META1 ======> got hit (5) > > I have > meta __META2 (__SUBMETAY + ..... + __SUBMETAYN) > with > dbg: rules: ran meta rule __META2 ======> got hit (8) > > I have > meta __META_NO (__SUBMETAZ || ..... || _SUBMETAZN ) > which is not hit. > > And finally > meta RESULT ((! __META_NO) && __META1 > 1 && __META2 > 6) > score RESULT 3 > > And RESULT is not hit/evaluated.
Would need exact sample of ruleset, this is too vague to work on. What are all the __SUBMETAs? You can also need to use -D rules,rules-all to see any "unrun" rules. > There is something really odd going on with meta rules on SA4. It's a massive change as described in Bug 7735, more than likely that some bugs can remain. But IMO it's still worth it for the most robust logic especially working with async network rules and stuff.
