> > > /20[1-9][0-9]/ --> /20[2-9][0-9]/ > RW,
thank you... exactly what we thought. exactly what others said/thought. we changed it to this before the update and still had the issue. so we changed back to the older version and then zero'd the score. waitied for the update after the update, changed the score to a small positive value to re-enable yet the rule is still *hitting* for some reason... since it is a header rule, what should i start looking at to see where the issue is coming from? somewhere in SA? should i enable special logging? or, should i check the MTA and it's assigns that deal with the header? - rh
