RE: SMB Alerts w/MySQL

["Paul D. Shaffer" <paulshaf () earthlink net>]

Yeah, I tried that (even though I couldn't find it in the documentation
anywhere).  Snort says: "WARNING* unknown output plugin "smbalert",
ignoring!

-M works fine on the cmdline, so what have I overlooked?

Paul

-----Original Message-----
From: Kevin Pietersma [mailto:kev () attcanada net]
Sent: Friday, August 24, 2001 2:05 PM
To: Paul D. Shaffer; snort-users () lists sourceforge net
Subject: Re: [Snort-users] SMB Alerts w/MySQL


Don't use -M on the command-line.  Specify SMB output in your snort.conf

output database: alert, mysql, dbname=snort user=snort host=10.*.*.*
password=***** sensor_name=name detail=full
output smbalert: /etc/snort/smbhosts

cheers,
kev

At 01:15 PM 8/24/01 -0600, Paul D. Shaffer wrote:

>         Does anyone know a way to get SMB alert working in conjunction
> with MySQL
> logging?  Is there a way to config SMB alert as an output plugin in
> snort.conf?  Whenever I use the -M switch on the cmdline, MySQL logging
> stops - with the obligatory warning about command-line override, of course.
> tks...
>
> cheers,
>
> Paul
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users