Re: logging portscans to MySQL

[Mike Diehn <mdiehn () vicinity com>]

* Jed Pickel (jed () pickel net) [07 31, 2001 23:30]:
> On Tue, Jul 31, 2001 at 07:01:02PM -0400, Mike Diehn wrote:
> > I'm finding a bunch of "unique" signatures because all the
> > spp_portscan events that I've (somehow) told snort to send to my
> > SQL database have unique signatures.
> >
> >   output database: alert_log, mysql, user=snort dbname=snort host=mysqlserver
> >
> > Dumb?  I can't find clear documentation about the differences
> > between alert_log, log, alert, etc.
>
> Here are the differences in reference to the database plugin.
>
> "alert" - logs messages from spp_portscan... Messages go in the
>           "signature" table. Obviously this is not the desired
>           behavior one would want. A portscan table will be added when
>           output from spp_portscan is structured and easily parseable.
>  
> "log"   - does not log messages from spp_portscan to the database. 
>           Some analysis tools such as ACID, can read the portscan log files.
>
> "alert_log" - as far as I know there is no pre-defined facility called
>           alert_log; however, you could define your own.
>
> I intend to add a portscan table by the next major release of snort.

Thanks very much, Jed.  

I've built a very lightweight system (eight sensors and a
syslog/SQL/ACID machine) to get familiar with the componenats in
preperation for building a full-scale system.

In my getting-to-know-you version, I configured the sensors with
alert_log on the database line and they put both spp_portscan and
regular log messages into the SQL database.

It seems to be a combo facility.

Mike


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users