Output unified

[lmarcilly () aressi fr]

Hi all,

i have difficulties to understand what informations are logged and how they are logged...

At the beginning, i've used the output alert_unified of snort, so it create the snort.alert file and a lot of 
directories (for example 192.168.1.100, 192.168.1.5, 255.255.255.255) I just add that i use three rules in order to 
test the output :

alert tcp any any -> any any (msg:"tcp snort";)
alert udp any any -> any any (msg:"udp snort";)
alert icmp any any -> any any (msg:"icp snort";)

So i think that snort.alert contain alert informations and the directoris other log information, am i wrong?

Now, i use output alert unified and log_unified, so i have one snort.alert file and one snort.log file. I want to know 
if informations in the snort.log are the same as in directories? 

And what about barnyard using files? Does it log the same thing in the two situation? Or does it log more information 
with the directories?

Thanks a lot for your help!

lm.





-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users