Collaborative phase in SecDefaultAction

Hi All,

     Which phase is better for Collaborative Detection in the 
SecDefaultAction?  I see that the default is phase 1 for Self-Contained 
Mode, is there any benefit to using phase1 for Collaborative?

SecDefaultAction "phase:2,pass,log,noauditlog"
SecDefaultAction "phase:1,pass,log,noauditlog"

     I am running the latest 2.7.2 modsecurity.

     Thanks,

~Jeremy

-- 
--

Jeremy Brock

XtremeServices.Net
Xtreme Services, LLC

------------------------------------------------------------------------------
The Go Parallel Website, sponsored by Intel - in partnership with Geeknet, 
is your hub for all things parallel software development, from weekly thought 
leadership blogs to news, videos, case studies, tutorials, tech docs, 
whitepapers, evaluation guides, and opinion stories. Check out the most 
recent posts - join the conversation now. http://goparallel.sourceforge.net/
_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/