Re: Double logging

[Martin Roesch <roesch () sourcefire com>]

What preprocessors do you have turned on?  Are all the double logged
packets TCP?  Do you get double logged packets for other protocols?

     -Marty

> "Selder, Patrick [NCSBE - Non JJ]" wrote:
>
> I'm getting all alerts double logged in the mysql database. When I
> examen the contents they're exactly the same.
> Even the sequence number is the same.
>
> I tested with a single packet that triggers a rule. The packet gets
> logged twice.
> In the firewall logs I noticed only one packet being blocked so I had
> the idea that one packet slipped through. After searching I came to
> the conclusion this wasn't the case. So it must be with snort -> mysql
> is guess.
>
> I'm running snort 1.8-1 beta 2 build 44 with logging for log and alert
> to mysql on a red-hat 7.0 box. Reporting is via acid and demarc.
>
> Any idea's where to look?
>
> Patrick

--
Martin Roesch
roesch () sourcefire com
http://www.sourcefire.com - http://www.snort.org

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users