RE: SMB Alerts w/MySQL

[Kevin Pietersma <kev () attcanada net>]

Did you compile SMB support into SNORT?

./configure --enable-smbalerts --with-mysql=/usr

kev


At 02:36 PM 8/24/01 -0600, Paul D. Shaffer wrote:
> Yeah, I tried that (even though I couldn't find it in the documentation
> anywhere).  Snort says: "WARNING* unknown output plugin "smbalert",
> ignoring!
>
> -M works fine on the cmdline, so what have I overlooked?
>
> Paul
>
> -----Original Message-----
> From: Kevin Pietersma [mailto:kev () attcanada net]
> Sent: Friday, August 24, 2001 2:05 PM
> To: Paul D. Shaffer; snort-users () lists sourceforge net
> Subject: Re: [Snort-users] SMB Alerts w/MySQL
>
>
> Don't use -M on the command-line.  Specify SMB output in your snort.conf
>
> output database: alert, mysql, dbname=snort user=snort host=10.*.*.*
> password=***** sensor_name=name detail=full
> output smbalert: /etc/snort/smbhosts
>
> cheers,
> kev
>
> At 01:15 PM 8/24/01 -0600, Paul D. Shaffer wrote:
>
> >         Does anyone know a way to get SMB alert working in conjunction
> > with MySQL
> >logging?  Is there a way to config SMB alert as an output plugin in
> >snort.conf?  Whenever I use the -M switch on the cmdline, MySQL logging
> >stops - with the obligatory warning about command-line override, of course.
> >tks...
> >
> >cheers,
> >
> >Paul
> >
> >
> >_______________________________________________
> >Snort-users mailing list
> >Snort-users () lists sourceforge net
> >Go to this URL to change user options or unsubscribe:
> >http://lists.sourceforge.net/lists/listinfo/snort-users
> >Snort-users list archive:
> >http://www.geocrawler.com/redir-sf.php3?list=snort-users


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users