RE: spp_anomsensor: Anomaly threshold exceeded in a lert.log

[francisv () dagupan com]

Hi Erek,

How do I turn off alert logging in /var/log/snort/alert and divert
everything to MySQL?

-----Original Message-----
From: Erek Adams [mailto:erek () theadamsfamily net] 
Sent: Monday, September 09, 2002 5:50 PM
To: francisv () dagupan com
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] spp_anomsensor: Anomaly threshold exceeded in
alert.log

On Mon, 9 Sep 2002 francisv () dagupan com wrote:

> I'm logging all alerts to MySQL but why is Snort producing
> /var/log/snort/alert? Here's the content (and continuously growing):
>
> [**] [104:1:1] spp_anomsensor: Anomaly threshold exceeded: 13.3085 [**]
> 09/09-14:29:10.585623 195.159.0.151:40167 -> 202.91.161.5:8081
> TCP TTL:49 TOS:0x20 ID:49962 IpLen:20 DgmLen:60 DF
> ******S* Seq: 0xF030EEA5  Ack: 0x0  Win: 0x16D0  TcpLen: 40
> TCP Options (5) => MSS: 1460 SackOK TS: 2591895224 0 NOP WS: 0

Use 'snort -N <other options>'.

[...]

[erek@merf]/var/log/snort#snort -\?
Initializing Output Plugins!

-*> Snort! <*-
Version 1.9.0beta6 (Build 202)
By Martin Roesch (roesch () sourcefire com, www.snort.org)
USAGE: snort [-options] <filter options>
Options:

[...snip...]
        -N         Turn off logging (alerts still work)
[...snip...]

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


-------------------------------------------------------
This sf.net email is sponsored by: OSDN - Tired of that same old
cell phone?  Get a new here for FREE!
https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users