Snort 3 Config File Question (1)

[Jim Campbell <jim () w4bqp net>]

I don't understand the relationship of the various configuration files 
in /opt/snort/etc/snort.

Three files appear to be configuration files: snort.lua  (--Snort++ 
configuration), snort_config (-- Snort prototype configuration) and 
snort_defaults.lua (-- Snort++ defaults). While snort_defaults.lua 
doesn't say it is a configuration file, most if not all of its arguments 
are configuration items.

Snort.lua checks for the presence of snort_config 
(require('snort_config') -- for loading) but it doesn't appear to use it.
Snort.lua appears to call snort_defaults.lua (dofile(conf_dir .. 
'/snort_defaults.lua')).

Snort_config checks to see if itself is there (require("snort_config")).
Snort_config appears to call snort_defaults.lua (dofile(conf_dir .. 
'/snort_defaults.lua')).

Maybe I've sorted this out. Please correct me if I'm wrong. For the 
configuration file I should use either snort.lua OR snort_configuration. 
Snort_defaults.lua contains parameters that are more stable, i.e., that 
need to be changed less often.

But if snort.lua is an alternative for snort_config why does it check to 
see if snort_config is present?

Thank you,

Jim

--
"We are not human beings having a spiritual experience;
we are spiritual beings having a human experience."
---Pierre Teilhard de Chardin

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!