commenting out rules?

["Sheahan, Paul (PCLN-NW)" <Paul.Sheahan () priceline com>]

I am seeing a ton of "http directory traversals" appear in my snort logs
which I have determined to be normal in my environment. So I commented out
this rule in web-misc.rules. Then I killed and re-ran Snort. But it is still
appearing in my alert log. I tried removing the line from web-misc.rules all
together just be sure, and it still keeps appearing in the logs as a
possible attack.

What am I missing? How do I get Snort to stop checking for this attack and
others like it?

Thanks!
Paul

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users