Snort mailing list archives
RE: Alert but NOT log?
From: "Sheahan, Paul (PCLN-NW)" <Paul.Sheahan () priceline com>
Date: Fri, 5 Apr 2002 13:59:03 -0500
Interesting.....I tried this feature out, but it doesn't appear to work. I added this to snort.conf: ruletype info { type alert output alert_fast: alert output log_null } Then created a rule like this: info tcp $EXTERNAL_NET any -> any 80 (msg:"HTTrack crawler detected"; content: "HTTrack"; nocase;) The alert worked, but it was also logged. I'm using Version 1.8.4 (Build 99) on RHLinux7.0 Anyone else get this feature to work? Thanks! Paul Sheahan Manager of Information Security Priceline.com paul.sheahan () priceline com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Alert but NOT log? Sheahan, Paul (PCLN-NW) (Apr 03)
- <Possible follow-ups>
- RE: Alert but NOT log? Sheahan, Paul (PCLN-NW) (Apr 03)
- Re: Alert but NOT log? james (Apr 04)
- Re: Alert but NOT log? Erek Adams (Apr 04)
- Re: Alert but NOT log? james (Apr 04)
- RE: Alert but NOT log? Sheahan, Paul (PCLN-NW) (Apr 05)