Re: unified2 output

[Curt Shaffer <cshaffer () gmail com>]

Worked like a charm. Thanks!

On Wed, May 5, 2010 at 10:26 AM, Joel Esler <jesler () sourcefire com> wrote:
> Remove your "-A fast -b" from your command line.  Remember that command line
> overrides conf file.
> J
>
> On Wed, May 5, 2010 at 10:13 AM, Curt Shaffer <cshaffer () gmail com> wrote:
> > I'm having an issue with an upgrade I just did to the latest Snort
> > version ( Version 2.8.6 (Build 38)) on a CentOS 5.4 install. Snort
> > seems to run but snort seems to disregard my unified2 output in the
> > configuration. Here is my output portion of my config:
> >
> > output unified2: filename snort.u2, limit 128
> >
> > With that I would expect the file in /var/log/snort to be called
> > snort.u2. Is that correct? What I get insstead is a file named
> > snort.log.xxxxxxxxxx (the x's change on every start).
> >
> > Here is my process list when I start Snort:
> >
> >  /usr/local/bin/snort -A fast -b -d -D -i eth1 -u snort -g snort -c
> > /etc/snort/snort.conf -l /var/log/snort
> >
> > I did ensure that I do not have any other outputs in the config.
> >
> > Any suggestions?
> >
> > Thanks
> >
> > Curt
> >
> >
> > ------------------------------------------------------------------------------
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users

------------------------------------------------------------------------------
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users