Re: logging portscans to MySQL

[Jed Pickel <jed () pickel net>]

On Tue, Jul 31, 2001 at 07:01:02PM -0400, Mike Diehn wrote:
> I'm finding a bunch of "unique" signatures because all the
> spp_portscan events that I've (somehow) told snort to send to my
> SQL database have unique signatures.
>
>   output database: alert_log, mysql, user=snort dbname=snort host=mysqlserver
>
> Dumb?  I can't find clear documentation about the differences
> between alert_log, log, alert, etc.

Here are the differences in reference to the database plugin.

"alert" - logs messages from spp_portscan... Messages go in the
          "signature" table. Obviously this is not the desired
          behavior one would want. A portscan table will be added when
          output from spp_portscan is structured and easily parseable.
 
"log"   - does not log messages from spp_portscan to the database. 
          Some analysis tools such as ACID, can read the portscan log files.

"alert_log" - as far as I know there is no pre-defined facility called
          alert_log; however, you could define your own.

I intend to add a portscan table by the next major release of snort.

* Jed

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users