Re: Diff between max_queue and log (README.event_queue)

["Joel Esler (jesler)" <jesler () cisco com>]

https://github.com/vrtadmin/snort-faq <— the official Snort FAQ, which I keep updated.

But the answer to your question is yes.

--
Joel Esler
Open Source Manager
Threat Intelligence Team Lead
Vulnerability Research Team


On Mar 27, 2014, at 12:54 PM, Balasubramaniam Natarajan <bala150985 () gmail com<mailto:bala150985 () gmail com>> wrote:

HI

Could some one please explain the difference between max_queue and log ?  I don't understand what is ment by "only 8 
events will be stored for a single packet or stream".  So if we have 8 defined for max_queue and 3 for log would that 
mean snort will log just 3 out of the 8 events which got triggered for that packet/stream ?

https://github.com/jasonish/snort/blob/master/doc/README.event_queue


max_queue


----------

This determines the maximum size of the event queue.  For example, if the
event queue has a max size of 8, only 8 events will be stored for a single



packet or stream.

The default value is 8.

log


---

This determines the number of events to log for a given packet or stream.
You can't log more than the max_event number that was specified.




The default value is 3.


--
Regards,
Balasubramaniam Natarajan
www.blog.etutorshop.com<http://www.blog.etutorshop.com/>
------------------------------------------------------------------------------
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net<mailto:Snort-users () lists sourceforge net>
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!