thresholding not working

["Lawrence R. Hughes, Sr." <lhughes () safemedia com>]

Hi,

We have tried everything to get thresholding (threshold.conf) working in 2.8.6.1?
Here is our code within threshold.conf:


event_filter gen_id 1, sig_id 384, type limit, track by_src, count 1, seconds 3600
event_filter gen_id 1, sig_id 408, type limit, track by_src, count 1, seconds 3600
event_filter gen_id 1, sig_id 366, type limit, track by_src, count 1, seconds 3600
event_filter gen_id 1, sig_id 128, type limit, track by_src, count 1, seconds 3600
event_filter gen_id 1, sig_id 648, type limit, track by_src, count 1, seconds 3600
event_filter gen_id 1, sig_id 1394, type limit, track by_src, count 1, seconds 3600
event_filter gen_id 1, sig_id 2006402, type limit, track by_src, count 1, seconds 3600
event_filter gen_id 1, sig_id 2001219, type limit, track by_src, count 1, seconds 3600
event_filter gen_id 1, sig_id 124, type limit, track by_src, count 1, seconds 3600
event_filter gen_id 1, sig_id 122, type limit, track by_src, count 1, seconds 3600
event_filter gen_id 1, sig_id 2006380, type limit, track by_src, count 1, seconds 3600
event_filter gen_id 3, sig_id 119, type limit, track by_src, count 1, seconds 3600

What are we doing wrong or is thresholding broken?

Thanks,
Larry



------------------------------------------------------------------------------
Protect Your Site and Customers from Malware Attacks
Learn about various malware tactics and how to avoid them. Understand 
malware threats, the impact they can have on your business, and how you 
can protect your company and customers by using code signing.
http://p.sf.net/sfu/oracle-sfdevnl

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users