RE: Snort and SQL logging

[francisv () dagupan com]

My `output database' has:

        output database: log, mysql, user=snort password=password
dbname=snortdb 
                host=localhost 

Is it necessary to put `encoding=hex detail=full' and `alert' instead of
just `log'? I'm using ACID to wade through the reports.

-----Original Message-----
From: John Sage [mailto:jsage () finchhaven com] 
Sent: Friday, September 13, 2002 8:53 PM
To: francisv () dagupan com
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] Snort and SQL logging

On Fri, Sep 13, 2002 at 08:28:34AM +0800, francisv () dagupan com wrote:
> Hi all,
>
> Does your snort log /var/log/snort/alert even if you log the alerts on a
SQL
> database?

Yes.

In my snort.conf for snort 1.8.7, I do both:

<snip>
# -------------------------------------------------
# output alert_full
output alert_full: /var/log/snort/alert187.full
# keep as from 1.8.4

<snip>

# output database: log, mysql, user=root password=test dbname=db
#   host=localhost
output database: alert, mysql, user=toot password=p4ssw0rd \
  dbname=snort host=[host_name] encoding=hex detail=full
# keep as from 1.8.4
<snip>


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users