Re: Output Plugin writing

[Jason Brvenik <jasonb () sourcefire com>]

It certainly clears it up. As a general rule, one should not write
output plugins for the engine as they tend to slow it down and add
unneeded overhead. The recommended way to perform these actions is to
use unified output and a post processing piece of code to do the
transforms to what ever system you choose. Barnyard is fairly easy to
work with as are the perl and ruby unified tools. If you would like
specific assistance please feel free to mail me privately.


eschnei () CLEMSON EDU wrote:
> I guess I wasn't being clear enough earlier, my apologies. I need to use a
> plug-in, or write a plug-in that allows me to take selected data from the
> packet and put it in a pike delimited file so our reporting program we
> already have in place can read the file. My problem is, I'm having trouble
> finding a template to follow, and the attributes for the different data
> structures, especially the Packet one. I hope that helps clear things up.
>
> Thanks,
> Brian
>
>   
> > I forgot to mention that you can use the ruby unified code that Caswell
> > put out too.
> >
> > http://www.shmoo.com/~bmc/software/ruby/unified.html
> >
> >     


-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users