Re: output config

[Laszlo Toth <laszlo.toth () linguamatics com>]

Hi,

Thanks, this solved the problem.

Laszlo

Tuesday, June 16, 2015, 2:37:29 PM, you wrote:

> Right. Specifying an output plugin on the command line enables the one
> specified and disables any plugin you have enabled in your config. Try
> removing -A fast.

> On 6/16/15, 6:13 AM, "Laszlo Toth" <laszlo.toth () linguamatics com> wrote:

> > Hi Carter,
> >
> > -A fast is already specified. The snort command running is
> > /usr/sbin/snort -A fast -b -d -D -i br0 -u snort -g snort -c
> > /etc/snort/snort.conf -l /var/log/snort
> >
> > Thanks,
> > Laszlo
> >
> > Monday, June 15, 2015, 11:46:20 AM, you wrote:
> >
> > > ³-A fast² will override the configured output plugin.
> >
> > > Thanks,
> > > Carter
> >
> > > On 6/12/15, 6:38 AM, "Laszlo Toth" <laszlo.toth () linguamatics com> wrote:
> >
> > > > Hi,
> > > >
> > > > I'm  trying  to change the way how snort logs the alerts but it looks
> > > > like my changes are being ignored.
> > > >
> > > > The corresponding entries in snort.conf:
> > > > output alert_unified2: filename alert, limit 12800, nostamp
> > > > output alert_unified2: filename alert_test, limit 5, nostamp
> > > >
> > > > The  result  is  still  the default behaviour. Alert is rotated after
> > > > 128MB written and nothing is logged to alert_test.
> > > >
> > > > The snort command is /usr/sbin/snort -A fast -b -d -D -i br0 -u snort -g
> > > > snort -c /etc/snort/snort.conf -l /var/log/snort
> > > >
> > > > What am I missing?
> > > >
> > > > Thanks,
> > > > Laszlo


------------------------------------------------------------------------------
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!