Snort mailing list archives
snort not record alert
From: troxlinux <xserverlinux () gmail com>
Date: Thu, 8 Dec 2011 12:26:24 -0600
Hi list, I am trying to run snort in my server firewall, following some guides especially that of snort with centos 5 of the site snort.org, everything one carries out with success but I don't see that snort records alerts in the BD mysql and I don't see any event in the log of snort... any idea? look my log : ule application order: activation->dynamic->pass->drop->sdrop->reject->alert->log Verifying Preprocessor Configurations! ICMP tracking disabled, no ICMP sessions allocated pcap DAQ configured to passive. Acquiring network traffic from "eth0". Reload thread starting... Reload thread started, thread 0x42090940 (9278) Decoding Ethernet WARNING: normalizations disabled because DAQ can't replace packets. database: compiled support for (mysql) database: configured to use mysql database: schema version = 107 database: host = localhost database: user = snortmen database: database name = snort database: sensor name = 2.0.0.0 database: sensor id = 1 database: data encoding = hex database: detail level = full database: ignore_bpf = no database: using the "log" facility --== Initialization Complete ==-- ,,_ -*> Snort! <*- o" )~ Version 2.9.1.2 IPv6 GRE (Build 84) '''' By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team Copyright (C) 1998-2011 Sourcefire, Inc., et al. Using libpcap version 1.1.1 Using PCRE version: 6.6 06-Feb-2006 Using ZLIB version: 1.2.3 Rules Engine: SF_SNORT_DETECTION_ENGINE Version 1.15 <Build 18> Preprocessor Object: SF_DNS (IPV6) Version 1.1 <Build 4> Preprocessor Object: SF_SSLPP (IPV6) Version 1.1 <Build 4> Preprocessor Object: SF_IMAP (IPV6) Version 1.0 <Build 1> Preprocessor Object: SF_SMTP (IPV6) Version 1.1 <Build 9> Preprocessor Object: SF_FTPTELNET (IPV6) Version 1.2 <Build 13> Preprocessor Object: SF_SSH (IPV6) Version 1.1 <Build 3> Preprocessor Object: SF_SIP (IPV6) Version 1.1 <Build 1> -- rickygm http://gnuforever.homelinux.com ------------------------------------------------------------------------------ Learn Windows Azure Live! Tuesday, Dec 13, 2011 Microsoft is holding a special Learn Windows Azure training event for developers. It will provide a great way to learn Windows Azure and what it provides. You can attend the event by watching it streamed LIVE online. Learn more at http://p.sf.net/sfu/ms-windowsazure _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- snort not record alert troxlinux (Dec 10)