Scott R. Shinn

Packages have just been updated to 22.4.1+ are you still running into problems with this?

Not sure I follow your test case here. What are you trying to do?

Have you got an example of the bad rule you were creating so I can use that for a test case/regression testing?

You mean the parent referred by the if_sid? A rule without an if_sid is just a regular rule

Yup, its in progress. Already done for the atomic ossec users

Should be good to go now

Could it be better? Yes, but I dont see this as an issue in this case since we're using a hash of the value (rather than the value) that results...

Closing this one as out of date, looks like it was just a missing dependency

There are some updates coming up in the atomic-testing channel, do you think you can try these out to see if they cover it? You can upgrade with: yum --enablerepo=atomic-testing...

These packages have been published to the atomic repo, let us know if you're still having a problem otherwise we'll close this one out shortly