SARE guys -- any chance those rules could be simply zeroed out (ie. replaced with "meta NAMEOFRULE (0)" or similar) in the short term, until they're fixed properly?
I'm seeing increasing amounts of problems caused by this bug around the web -- specifically, log partitions filling up due to the error messages. I suspect it may also be contributing to at least some of the "3.2.0 causes slowdown" reports, since that amount of syslog traffic would definitely impact system performance. (The alternative is to do a 3.2.1 release which catches this bug somehow at runtime, and disables the rules in code; or to simply suggest that people seeing the bug stop using the affected rulesets.) --j.
