Re: Output unified

[Jason Brvenik <jasonb () sourcefire com>]

lmarcilly () aressi fr wrote:
> Hi all,
>
> i have difficulties to understand what informations are logged and
> how they are logged...
>
> At the beginning, i've used the output alert_unified of snort, so it
> create the snort.alert file and a lot of directories (for example
> 192.168.1.100, 192.168.1.5, 255.255.255.255) I just add that i use
> three rules in order to test the output :

alert_unified does not create directories. -A (alert_fast) will create 
what you describing IIRC. alert_unified should only create a single file 
with all of the alerts in it.

FYI: command line options override config file settings.

> alert tcp any any -> any any (msg:"tcp snort";) alert udp any any ->
> any any (msg:"udp snort";) alert icmp any any -> any any (msg:"icp
> snort";)

I hope this is only testing. That would be an insane use of the snort 
alerting capabilities.

> So i think that snort.alert contain alert informations and the
> directoris other log information, am i wrong?

close enough.

> Now, i use output alert unified and log_unified, so i have one
> snort.alert file and one snort.log file. I want to know if
> informations in the snort.log are the same as in directories?

information in the .log file is actual packet data and alert 
information. The .alert file is just alert information.

> And what about barnyard using files? Does it log the same thing in
> the two situation? Or does it log more information with the
> directories?

It is the same information in a more usable format for automated 
processing. unified.log files are essentially alert headers with a pcap 
wrapped into a nice record format.



-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users