Re: Snort not logging to the /var/log/snort/alert file

[ids () san rr com]

thank you for the reply.

I'm a little confused about what you mean here:

Before anything you need to pass this path in your line, preceded by the
swtch "-l" Format: -l /var/log/snort.


but I did type chmod 777 /var/log/snort under root. Is this all I need to do?

Sorry for all the dumb questions :)


Alan



-------------------------
Ok, let's go
You need to give permissions to the snort. It needs to write in the
/var/log/snort.

Before anything you need to pass this path in your line, preceded by the
swtch "-l" Format: -l /var/log/snort.

If you are on a ---test--- environment, just type chmod 777
/var/log/snort. The "777" will gine everyone the possibility to read,
write and execute.


Let me know if your problem persist.
Best regards,
Rodrigo Ramos



On Wed, 2004-03-24 at 16:47, ids () san rr com wrote:
> I'm a little embarrased to admit this but I'm kind of a Linux noob (I'm learning though). When you say permissions do 
> you mean permissions for the Snort user account I created or the Snort application itself. Also can somebody give me 
> the command to give permssions to Snort so it can write to the file (chmod?)? 
>
> Thanks for all the help!
>
>
> Alan
>
>
> _______________________________________
> Hi,
>
> Did you create it with the permissions? Did you give permissions to the
> snort to write on it?
>
>
> Best regards,
> Rodrigo Ramos
> http://www.triforsec.com.br
> http://www.defenselayer.com
>
>
> On Wed, 2004-03-24 at 15:06, ids () san rr com wrote:
> > Hi-
> >
> > I'm a goof and accidently deleted my /var/log/snort/alert file. After I deleted I tried to recreate the file. I 
> > noticed that Snort no longer writes alerts to this file. I've tried everything. Can anybody help me? Thanks in 
> > advance!
> >
> >
> > Alan
> >
> >
> >
> > -------------------------------------------------------
> > This SF.Net email is sponsored by: IBM Linux Tutorials
> > Free Linux tutorial presented by Daniel Robbins, President and CEO of
> > GenToo technologies. Learn everything from fundamentals to system
> > administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>  
>
>
>
> ______________________________________________________________________
> Hi,
>
> Did you create it with the permissions? Did you give permissions to the
> snort to write on it?
>
>
> Best regards,
> Rodrigo Ramos
> http://www.triforsec.com.br
> http://www.defenselayer.com
>
>
> On Wed, 2004-03-24 at 15:06, ids () san rr com wrote:
> > Hi-
> >
> > I'm a goof and accidently deleted my /var/log/snort/alert file. After I deleted I tried to recreate the file. I 
> > noticed that Snort no longer writes alerts to this file. I've tried everything. Can anybody help me? Thanks in 
> > advance!
> >
> >
> > Alan
> >
> >
> >
> > -------------------------------------------------------
> > This SF.Net email is sponsored by: IBM Linux Tutorials
> > Free Linux tutorial presented by Daniel Robbins, President and CEO of
> > GenToo technologies. Learn everything from fundamentals to system
> > administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users

 
 

Ok, let's go
You need to give permissions to the snort. It needs to write in the
/var/log/snort.

Before anything you need to pass this path in your line, preceded by the
swtch "-l" Format: -l /var/log/snort.

If you are on a ---test--- environment, just type chmod 777
/var/log/snort. The "777" will gine everyone the possibility to read,
write and execute.


Let me know if your problem persist.
Best regards,
Rodrigo Ramos



On Wed, 2004-03-24 at 16:47, ids () san rr com wrote:
> I'm a little embarrased to admit this but I'm kind of a Linux noob (I'm learning though). When you say permissions do 
> you mean permissions for the Snort user account I created or the Snort application itself. Also can somebody give me 
> the command to give permssions to Snort so it can write to the file (chmod?)? 
>
> Thanks for all the help!
>
>
> Alan
>
>
> _______________________________________
> Hi,
>
> Did you create it with the permissions? Did you give permissions to the
> snort to write on it?
>
>
> Best regards,
> Rodrigo Ramos
> http://www.triforsec.com.br
> http://www.defenselayer.com
>
>
> On Wed, 2004-03-24 at 15:06, ids () san rr com wrote:
> > Hi-
> >
> > I'm a goof and accidently deleted my /var/log/snort/alert file. After I deleted I tried to recreate the file. I 
> > noticed that Snort no longer writes alerts to this file. I've tried everything. Can anybody help me? Thanks in 
> > advance!
> >
> >
> > Alan
> >
> >
> >
> > -------------------------------------------------------
> > This SF.Net email is sponsored by: IBM Linux Tutorials
> > Free Linux tutorial presented by Daniel Robbins, President and CEO of
> > GenToo technologies. Learn everything from fundamentals to system
> > administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>  
>
>
>
> ______________________________________________________________________
> Hi,
>
> Did you create it with the permissions? Did you give permissions to the
> snort to write on it?
>
>
> Best regards,
> Rodrigo Ramos
> http://www.triforsec.com.br
> http://www.defenselayer.com
>
>
> On Wed, 2004-03-24 at 15:06, ids () san rr com wrote:
> > Hi-
> >
> > I'm a goof and accidently deleted my /var/log/snort/alert file. After I deleted I tried to recreate the file. I 
> > noticed that Snort no longer writes alerts to this file. I've tried everything. Can anybody help me? Thanks in 
> > advance!
> >
> >
> > Alan
> >
> >
> >
> > -------------------------------------------------------
> > This SF.Net email is sponsored by: IBM Linux Tutorials
> > Free Linux tutorial presented by Daniel Robbins, President and CEO of
> > GenToo technologies. Learn everything from fundamentals to system
> > administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users