Snort mailing list archives
Re: Not getting alerts in "alert" file.
From: waldo kitty <wkitty42 () windstream net>
Date: Tue, 30 Apr 2013 19:54:34 -0400
On 4/30/2013 14:14, Shields, Joseph (NIH/NIEHS) [C] wrote:
Hi. I am not sure if my running two snort processes (each monitoring a different network interface) is causing the alerts to NOT show up in the alert file?
each snort instance needs its own set of config and logging files... are you trying to share the same logging files? i would create /var/log/snort1 for the first instance and /var/log/snort2 for the second instance... i this way, each has its own alert and snort.log.xxxxxxxxxxxxxx files... i would also probably take the easy way out and use /etc/snort1.conf and /etc/snort2.conf but i'm sure that it is possible to use one config that has the main stuff that is all the same and then include different files that have the specifics for each instance... i would likely differentiate between them by setting and using environment variables... eg: in the first instance's startup script EXPORT whichsnort=snort1 in the second instance's startup script EXPORT whichsnort=snort2 and in the script it would have %whichsnort so the config would use something like include /path/%whichsnort-vars.conf i'm not where i can pull any actual working examples depicting this so i can only hope that i'm stating this in such a way as to light the lightbulb for you... the overall easiest way is to use completely separate confs, though... just make sure you edit the proper one and include any changes in both if you have to... -- NOTE: No off-list assistance is given without prior approval. Please keep mailing list traffic on the list unless private contact is specifically requested and granted. ------------------------------------------------------------------------------ Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET Get 100% visibility into your production application - at no cost. Code-level diagnostics for performance bottlenecks with <2% overhead Download for free and get started troubleshooting in minutes. http://p.sf.net/sfu/appdyn_d2d_ap1 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Not getting alerts in "alert" file. Shields, Joseph (NIH/NIEHS) [C] (Apr 30)
- Re: Not getting alerts in "alert" file. waldo kitty (Apr 30)