Snort mailing list archives
Can snort send alerts to the mysql database without writing an output file?
From: "Jacob, Raymond A Jr" <raymond.jacob () navy mil>
Date: Wed, 8 Mar 2006 16:12:46 -0500
Question: Can snort send alerts to the mysql database without writing an output file? Command line: ids# ./snort.sh start /usr/local/bin/snort -Dq -dev -o -A none -K none -c /usr/local/etc/snort/snort.conf -i mi0 -u user -g group Starting snort. relevant portion of snort.conf ids# sed -n '/^output/p' /usr/local/etc/snort/snort.conf output database: log, mysql, user=user dbname=ids password=xxxx host=loca lhost sensor_name=snort-ids output database: log, mysql, user=user dbname=ids_archive password=xxxx h ost=snorthost sensor_name=snort-ids When I run the above command line, I get no alerts. When I run the above command line without -A none and -K none I get alerts sent to ids database i.e./usr/local/bin/snort -Dq -dev -o -c /usr/local/etc/snort/snort.conf -i mi0 -u user -g group When I run with the -A none I get the pcap files but no alerts sent to ids database. Someone said try the -Y option that did not work in 2.4.3. Thank you for your help, Raymond
Current thread:
- Can snort send alerts to the mysql database without writing an output file? Jacob, Raymond A Jr (Mar 08)