Snort mailing list archives
Re: output config
From: "Carter Waxman (cwaxman)" <cwaxman () cisco com>
Date: Mon, 15 Jun 2015 10:46:20 +0000
³-A fast² will override the configured output plugin. Thanks, Carter On 6/12/15, 6:38 AM, "Laszlo Toth" <laszlo.toth () linguamatics com> wrote:
Hi, I'm trying to change the way how snort logs the alerts but it looks like my changes are being ignored. The corresponding entries in snort.conf: output alert_unified2: filename alert, limit 12800, nostamp output alert_unified2: filename alert_test, limit 5, nostamp The result is still the default behaviour. Alert is rotated after 128MB written and nothing is logged to alert_test. The snort command is /usr/sbin/snort -A fast -b -d -D -i br0 -u snort -g snort -c /etc/snort/snort.conf -l /var/log/snort What am I missing? Thanks, Laszlo -------------------------------------------------------------------------- ---- _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- output config Laszlo Toth (Jun 12)
- Re: output config Carter Waxman (cwaxman) (Jun 15)
- Re: output config Laszlo Toth (Jun 16)
- Re: output config Carter Waxman (cwaxman) (Jun 16)
- Re: output config Laszlo Toth (Jun 16)
- Re: output config Laszlo Toth (Jun 16)
- Re: output config Carter Waxman (cwaxman) (Jun 15)