Snort mailing list archives
RE: alert_full won't create subdirectories for ip addresses when mysql logging is enabled
From: "L. Christopher Luther" <CLuther () Xybernaut com>
Date: Mon, 2 Dec 2002 15:25:20 -0500
I too have been bitten by this issue, but for the life of me, I cannot find any reference for the log_ascii output plugin in the Snort docs: http://www.snort.org/docs/SnortUsersManual.pdf Is this something that is undocumented? - Christopher -----Original Message----- Date: Fri, 29 Nov 2002 11:04:03 -0500 From: "Andrew R. Baker" <andrewb () snort org> To: Peter Schobel <drifter () zenfinity com> CC: snort-users () lists sourceforge net Subject: Re: [Snort-users] alert_full won't create subdirectories for ip addresses when mysql logging is enabled Peter Schobel wrote:
I have been searching the lists and have found a few posts on this problem
but
couldn't find any posts that described a resolution I am using output alert_full output alert_syslog: LOG_AUTH LOG_ALERT and output database: log, mysql, user=user password=pass dbname=snortlogs host=localhost as soon as I turn on the database output, the ip address subdirectories in
/var/log/snort are not created, when the database logging is disabled, functionality returns to normal I am starting snort with daemon /usr/sbin/snort-mysql -l /var/log/snort -D -p\ -i $INTERFACE -c /etc/snort/snort.conf
If you are looking for the sub-directory output, you need to enable the log_ascii output plugin. The reason you see them when you have the database output plugin disabled is because log_ascii is the default packet logging mechanism. -A
Current thread:
- alert_full won't create subdirectories for ip addresses when mysql logging is enabled Peter Schobel (Nov 29)
- Re: alert_full won't create subdirectories for ip addresses when mysql logging is enabled Andrew R. Baker (Nov 29)
- ACID SQL error Faber Fedor (Nov 29)
- <Possible follow-ups>
- RE: alert_full won't create subdirectories for ip addresses when mysql logging is enabled L. Christopher Luther (Dec 02)
- Re: alert_full won't create subdirectories for ip addresses when mysql logging is enabled Andrew R. Baker (Dec 02)
- FW: Re: alert_full won't create subdirectories for ip addresses when mysql logging is enabled Frank Knobbe (Dec 04)