Snort mailing list archives
output config
From: Laszlo Toth <laszlo.toth () linguamatics com>
Date: Fri, 12 Jun 2015 11:38:42 +0100
Hi, I'm trying to change the way how snort logs the alerts but it looks like my changes are being ignored. The corresponding entries in snort.conf: output alert_unified2: filename alert, limit 12800, nostamp output alert_unified2: filename alert_test, limit 5, nostamp The result is still the default behaviour. Alert is rotated after 128MB written and nothing is logged to alert_test. The snort command is /usr/sbin/snort -A fast -b -d -D -i br0 -u snort -g snort -c /etc/snort/snort.conf -l /var/log/snort What am I missing? Thanks, Laszlo ------------------------------------------------------------------------------ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- output config Laszlo Toth (Jun 12)
- Re: output config Carter Waxman (cwaxman) (Jun 15)
- Re: output config Laszlo Toth (Jun 16)
- Re: output config Carter Waxman (cwaxman) (Jun 16)
- Re: output config Laszlo Toth (Jun 16)
- Re: output config Laszlo Toth (Jun 16)
- Re: output config Carter Waxman (cwaxman) (Jun 15)