logfile problem

[Dino <no.sec () tin it>]

hi guys!

this thing is drivin' me crazy. finally i installed snort and the 
snortsam-plugin and it seems everything is running fine. i still have 
some problems with the logfiles. snort keeps sending the alerts to the 
/var/log/syslog. now, is it possible to have the alerts also in a file, 
let's say /var/log/snort/alerts.log? i googled, i searched but nothin'. 
i finally realized i'm probably to ignorant..so i need your help!

this is the output i get in the syslog:

15:40 windino snort: [1:1420:3] SNMP trap tcp [Classification: Attempted 
Information Leak] [Priority: 2]: {TCP} 192.xxx.xxx.xxx:58705 -> 
192.xxx.xxx.xxx:162


but i'd like something like that in my alert.log file:

[**] [1:620:6] SCAN Proxy Port 8080 attempt [**]
[Classification: Attempted Information Leak] [Priority: 2]
05/04-18:06:46.093567 192.xxx.xxx.xxx:40021 -> 192.xxx.xxx.xxx:8080
TCP TTL:64 TOS:0x0 ID:8501 IpLen:20 DgmLen:60 DF
******S* Seq: 0xF05C88E4  Ack: 0x0  Win: 0x16D0  TcpLen: 40
TCP Options (5) => MSS: 1460 SackOK TS: 354855377 0 NOP WS: 0

i know, it's probably just 1 or 2 lines in the snort.conf. i tried 
several output-plugins, but anything worked.
so, any help is apreciated!

cu
Dino

P.S. slack 9.1/2.4.24



-------------------------------------------------------
This SF.Net email is sponsored by Sleepycat Software
Learn developer strategies Cisco, Motorola, Ericsson & Lucent use to 
deliver higher performing products faster, at low TCO.
http://www.sleepycat.com/telcomwpreg.php?From=osdnemail3
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users