mailing list archives
Re: Not getting alerts in "alert" file.
From: waldo kitty <wkitty42 () windstream net>
Date: Tue, 30 Apr 2013 19:54:34 -0400
On 4/30/2013 14:14, Shields, Joseph (NIH/NIEHS) [C] wrote:
Hi. I am not sure if my running two snort processes (each monitoring a different
network interface) is causing the alerts to NOT show up in the alert file?
each snort instance needs its own set of config and logging files... are you
trying to share the same logging files?
i would create /var/log/snort1 for the first instance and /var/log/snort2 for
the second instance... i this way, each has its own alert and
snort.log.xxxxxxxxxxxxxx files... i would also probably take the easy way out
and use /etc/snort1.conf and /etc/snort2.conf but i'm sure that it is possible
to use one config that has the main stuff that is all the same and then include
different files that have the specifics for each instance... i would likely
differentiate between them by setting and using environment variables...
eg: in the first instance's startup script
in the second instance's startup script
and in the script it would have %whichsnort so the config would use
i'm not where i can pull any actual working examples depicting this so i can
only hope that i'm stating this in such a way as to light the lightbulb for
you... the overall easiest way is to use completely separate confs, though...
just make sure you edit the proper one and include any changes in both if you
NOTE: No off-list assistance is given without prior approval.
Please keep mailing list traffic on the list unless
private contact is specifically requested and granted.
Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
Get 100% visibility into your production application - at no cost.
Code-level diagnostics for performance bottlenecks with <2% overhead
Download for free and get started troubleshooting in minutes.
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:
Please visit http://blog.snort.org to stay current on all the latest Snort news!