RE: Output plugins -differences between loggingmethods?

["Bob Walder" <bwalder () nss co uk>]

Whilst we have had far too many questions that could have been answered by
RTFM recently, I do not believe this is one of them.

Read his original question carefully, the re-read that section of the FAQ
you quoted - it doesn't answer it.

He is asking "since both LOG and ALERT appear to be producing the same
output, why should I use both of them? Except, if I only use LOG then I will
miss port scans....but if I only use ALERT, will I get full packet
contents....? etc, etc, etc"

A common question in my experience but not one I feel qualified to answer
succinctly

Regards,

Bob


-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net]On Behalf Of Saad Kadhi
Sent: 25 January 2002 23:24
To: Rockoff, Dan
Cc: 'snort-users () lists sourceforge net'
Subject: Re: [Snort-users] Output plugins -differences between
loggingmethods?


[PLEASE DROP THE HTML EMAIL. THIS IS NOT NETIQUETTE-COMPLIANT]

On Fri, 2002-01-25 at 17:39, Rockoff, Dan wrote:
> I have successfully set up snort logging to a MySql database, and it has
> been running fine for over a month now with no problems.
>
> I am curious however what the differences are between the "output
database:
> log, and output database: alert" functions.
>
> If I have both enabled, it looks like I get duplicate data for most hits
> with the exception of portscans.
>
> Should I just use alert, or am I losing something by not using the "log"
> facility?
Taken from
http://www.snort.org/docs/writing_rules/chap2.html#tth_sEc2.5:
Furthermore, there is a logging method and database type that must be
defined. There are two logging types available, log and alert. Setting
the type to log attaches the database logging functionality to the log
facility within the program. If you set the type to log, the plugin will
be called on the log output chain. Setting the type to alert attaches
the plugin to the alert output chain within the program.

Please see the documentation & FAQ on http://www.snort.org. They are
pretty well written & you should find answers to a lot of questions that
you may have before posting to this list. A good idea will be also to
search the archives at:
http://marc.theaimsgroup.com

HTH
--
/Saad --  [bsdguy () docisland org]
[pgp keyid: 35592A6D http://pgp.mit.edu]
# buy a geek-in-a-can, point nozzle at technical problem and spray
# if desesperate degauss your screen. it might solve your pb as well


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users