Snort mailing list archives

Re: SnortSAM + Snort 2.3.3

From: Frank Knobbe <frank () knobbe us>
Date: Tue, 03 May 2005 20:55:41 -0500

On Mon, 2005-05-02 at 13:59 -0500, Xavier Cabrera wrote:

I have recently problems with Snort 2.3.3 and SnortSAM.
Snort can detect the attack but doesn't send the packet to SnortSAM 
machine.
Can anyone help me???


The answer is right here:

May  2 13:52:53 core snort: command line overrides rules file alert plugin!


Does your Snort command line include a "-A full" or "-A fast"? Any "-A"
in the command line will override any output plugin that is configured
in snort.conf (such as Snortsam). Remove the -A from the command line
and Snort should work just fine.

Regards,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part

Current thread:

Problem with socket slice (Apr 29)
- Re: Problem with socket Anthony J Placilla (Apr 29)
  - Re[2]: Problem with socket slice (Apr 29)
    - Re: Re[2]: Problem with socket Paul Schmehl (Apr 29)
    - Re: Re[2]: Problem with socket Anthony J Placilla (Apr 29)
    - SnortSAM + Snort 2.3.3 Xavier Cabrera (May 03)
    - Re: SnortSAM + Snort 2.3.3 Frank Knobbe (May 03)
    - Re: SnortSAM + Snort 2.3.3 Xavier Cabrera (May 04)
- <Possible follow-ups>
- Re: Problem with socket John Creegan (Apr 29)
- Problem with socket slice (Apr 30)