Snort mailing list archives
Output Plugins
From: Eric Kahklen <eric () kahklen com>
Date: Thu, 09 Sep 2004 13:01:39 -0700
I am trying to setup my 1st snort box and was going through the snort.conf. I am going to be using ACID with mysql. From the docs, it says you can either use log or alert.
The example they include is:output database: log, mysql, user=root password=test dbname=db host=localhost
Is it better to use log vs. alert? Does that mean that mysql will only capture data that triggers rules written with the log action event?
Also, is there a way to point all snort logging period to go to one directory vs. being put into my messages directory?
Thanks, Eric -- ______________________________________________________________________ Seattle, WA ------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement onwho ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Output Plugins Eric Kahklen (Sep 09)
- Re: Output Plugins Jose Maria Lopez (Sep 10)