Snort mailing list archives
Re: logging portscans to MySQL
From: Jed Pickel <jed () pickel net>
Date: Tue, 31 Jul 2001 22:52:53 -0400
On Tue, Jul 31, 2001 at 07:01:02PM -0400, Mike Diehn wrote:
I'm finding a bunch of "unique" signatures because all the spp_portscan events that I've (somehow) told snort to send to my SQL database have unique signatures. output database: alert_log, mysql, user=snort dbname=snort host=mysqlserver Dumb? I can't find clear documentation about the differences between alert_log, log, alert, etc.
Here are the differences in reference to the database plugin. "alert" - logs messages from spp_portscan... Messages go in the "signature" table. Obviously this is not the desired behavior one would want. A portscan table will be added when output from spp_portscan is structured and easily parseable. "log" - does not log messages from spp_portscan to the database. Some analysis tools such as ACID, can read the portscan log files. "alert_log" - as far as I know there is no pre-defined facility called alert_log; however, you could define your own. I intend to add a portscan table by the next major release of snort. * Jed _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- logging portscans to MySQL Mike Diehn (Jul 31)
- Re: logging portscans to MySQL Jed Pickel (Jul 31)
- Re: logging portscans to MySQL Mike Diehn (Aug 01)
- Re: logging portscans to MySQL Jed Pickel (Jul 31)