RE: Re: alert_full won't create subdirectories for ip addresses when mysql logging is enabled

["Hicks, John" <JHicks () JUSTICE GC CA>]

Frank,
Out of curiosity, did you use it with 1.8??? I tried on and old copy and got
"*WARNING*: unknown output plugin "log_ascii", ignoring!". However, on my
1.9 node, it works great (I *love* having nicely organized packet files for
analysis)

Definately a needed feature, imho.

John

-----Original Message-----
From: Frank Knobbe [mailto:fknobbe () knobbeits com]
Sent: Monday, December 02, 2002 5:33 PM
To: snort-users () lists sourceforge net
Subject: Re: [Snort-users] Re: alert_full won't create subdirectories
for ip addresses when mysql logging is enabled


On Mon, 2002-12-02 at 15:04, Chris Green wrote:
> "Andrew R. Baker" <andrewb () snort org> writes:
> > Probably.  Maybe Chris can update the docs. ;) Basically, it is just
> > an output plugin for the default logging method.
>
> Yeah I will update the docs. Didn't even know that there was a way to
> manually enable that.  Even more suprised that people are using it :^)

I use it and love it. I have a script that goes through the directory
tree and emails the alerts. That way I can look at the packet content in
email (Subject is the alert, open email to see the packet content).
Creates a ton of mail though :)

Frank



-------------------------------------------------------
This SF.net email is sponsored by: Microsoft Visual Studio.NET 
comprehensive development tool, built to increase your 
productivity. Try a free online hosted session at:
http://ads.sourceforge.net/cgi-bin/redirect.pl?micr0003en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users