RE: Snort Logs

["grant" <grant () macaulayconsultants co uk>]

Setup snortsnarf 021111.1 with active perl build 635. Remove any output plugins from snort.conf and use the default 
alert.ids. Scan.log is from the portscan preprocessors, this also puts an entry in alert.ids so just go with this for 
starters. You do not need to run a web site to read the html reports.Snortsnarf changes a 25 Mbyte log into a 200 Mbyte 
report. It also likes to have enough memory. Once you have tuned rules alert.ids is not very big at all.
 
Grant

        -----Original Message----- 
        From: snort-users-admin () lists sourceforge net on behalf of Martin Jr., D. Michael 
        Sent: Tue 14/10/2003 14:42 
        To: snort-users () lists sourceforge net 
        Cc: 
        Subject: [Snort-users] Snort Logs