Re: ruletype doesn't work at all ?!

[Joe McAlerney <joey () SiliconDefense com>]

What are your command line options?  Are any of them overriding the
output facilities defined in your rule type?  -A and -s will do this.

-Joe M.

-- 
|   Joe McAlerney     joey () silicondefense com   |
| Silicon Defense - Technical Support for Snort |
|       http://www.silicondefense.com/          |
+--                                           --+

chlang wrote:
> I tried to do the ruletype inside the snort.conf hoping to get more actions
> in response.
> "icmp destination not reachable" is not what I will react when it occurs,
> just a log/alert is needed, so is "Login Incorrect"
> but a backdoor attack must raise a redalert, that send a mail or a winpopup
> to me....
>
> but enabling ruletype doesn't work for me, here is what I do:
>
> inside snort.conf
> ruletype redalert
> {
>   type alert
>   output alert_syslog: LOG_AUTH LOG_ALERT
>   output database: log, mysql, user=snort dbname=snort host=localhost
>   output alert_smb: winhost.lst
> }
> and have a test rule inside local-lib:
> redalert tcp any any -> any any (msg:"red-alert, test1"; content:"redtest1")
>
> get nothing to my syslog, database, or any popup.
> but it is working if I don't use any ruletype at all.
>
> Did I forget something ? compile option ?
> Thanks in advanced.
>
> chlang () kimo com
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users