Re: Barnyard woes

[Ken Gunderson <kgunders () teamcool net>]

On Tuesday 18 February 2003 08:16 pm, Andrew R. Baker wrote:
> Joerg Weber wrote:
>   > Here's my problem:
>   > 1) I'd like to use SnortCenter to maintain my sensors.
>   > SnortCenter adds the unified_plugin like this:
>   > output log_unified: filename snort-unified, limit 500
>   > but no alert_unified:
>   > Should I add this by hand via a preprocessor?
>
> If you are only using the database output, you do not need to the
> unified alert file.  All of the alert data should be in the unified
> log file.

[snip]

so one would specify both "log_acid_db" AND "alert_acid_db" in 
barnyard.conf and then get both alerts and logs going to db, correct?

[snip]

-- 
Best regards,

Ken Gunderson
PGP Key-- 9F5179FD

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.


-------------------------------------------------------
This SF.net email is sponsored by: SlickEdit Inc. Develop an edge.
The most comprehensive and flexible code editor you can use.
Code faster. C/C++, C#, Java, HTML, XML, many more. FREE 30-Day Trial.
www.slickedit.com/sourceforge
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users