Re: Output CSV Problem in latest Snort at Centos 7 and Ubuntu 18.04 64bit

[Dorian ROSSE via Snort-users <snort-users () lists snort org>]

I have the same error on Windows setup the test mode ask a alert.ids file in log directory without success for the 
file...

I have created the file in the good log without be known by the test mode

When I set up on Linux I was fallen on an error never answer by the snort community for output....

If you have question but without error I don't know how to help you,

Regards.


Dorian rosse.

Télécharger Outlook pour Android<https://aka.ms/ghei36>
________________________________
From: Rendi 7936 <rendi.7936 () gmail com>
Sent: Tuesday, September 10, 2019 4:58:45 PM
To: Dorian ROSSE <dorianbrice () hotmail fr>
Subject: Re: [Snort-users] Output CSV Problem in latest Snort at Centos 7 and Ubuntu 18.04 64bit

Thanks for your reply, i have found the culprit.

At first glance, i think snort will created two different output result if i use two output plugins.

But, what happened is snort only use one output plugins at one time.

Snort can not use two output plugins at one time.

Is it the design of snort ?



On Tue, Sep 10, 2019, 9:20 PM Dorian ROSSE <dorianbrice () hotmail fr<mailto:dorianbrice () hotmail fr>> wrote:
Or try It often error repair for your problem here :

https://www.snort.org/faq/my-snort-log-is-an-empty-file-what-could-be-the-cause

De : Snort-users <snort-users-bounces () lists snort org<mailto:snort-users-bounces () lists snort org>> De la part de 
Rendi 7936 via Snort-users
Envoyé : mardi 10 septembre 2019 11:32
À : snort-users () lists snort org<mailto:snort-users () lists snort org>
Objet : [Snort-users] Output CSV Problem in latest Snort at Centos 7 and Ubuntu 18.04 64bit

Good day, everyone.
Hello.

I need help to figure out what's wrong with my configuration in Snort.

1. I include output alert_csv: /var/log/snort/snort.csv timestamp,msg in snort.conf.

2. I have been checked snort.conf using snort -T and passed.

3. and i use alert tcp any any -> any any (msg:"Sample Metron Message from Snort"; sid:999158; ) to test snort, and 
give output as a CSV.

alert.csv is created, but it is empty. I pretty sure followed tutorial in 
https://www.snort.org/documents/snort-users-manual . But, alert.csv still empty.

Thank you for your time.
Best regards,
Rendiyono Wahyu Saputro

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette