On Fri, Jun 01, 2012 at 11:14:04AM +1000, Malcolm Herbert wrote: |I'd like to request an enhancement to this mechanism. I'd like to be |able to indicate that have I looked at a URL, but I want it to be |ignored only while it contains web content that has an associated |md5 or sha1 digest (for example, last-modify time may also be more |appropriate). | |This means that I can remove alerts from the output of the audit where |they have pending detail, but as soon as that is added to the link and |the digest changes, they will become visible again. This may also be |useful in cases where alert details change after they have already been |read and marked to be ignored which would prompt a further review. Crafting a simple Perl filter to do this work on the audit output seems to have solved the problem for me - except that at least in the case of the secunia alerts, they put the page view count in the page content, which Makes the digest approach break. Still, it's an improvement. Regards, Malcolm -- Malcolm Herbert This brain intentionally mjch%mjch.net@localhost left blank
Attachment:
pgpU6LeCRI7yh.pgp
Description: PGP signature