Fwd: too many false positive with mulitibyte
Kirk Bauer <[email protected]>
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
Can any experts offer their opinion? ---------- Forwarded message ---------- From: BERO <[email protected]> Date: 2009/12/21 Subject: too many false positive with mulitibyte To: [email protected] in logwatch/script/services/http @exploits '\\\x81', x81 is part of multibyte character, so this rule generate too many false positive in multibyte url such as keyword search, especially in Japan. I suggest delete this rule. bero