Re: (no subject)

[Matt Kettler <mkettler () evi-inc com>]

What's the command line you're passing to snort in /etc/rc.d/init.d/snort ?

It appears you have a command line option which is forcing a particular 
loging mode. Command line parameters to snort take priority over entries in 
snort.conf.


At 09:10 AM 4/9/2002 -0700, Federico Rena wrote:
> Hi, all.
>
> i've the question work with redhat 7.2 php 4.1 apache
> in my box,
> i did the procedure compilation an instalation buy
> have a problem
> with log the info at database.
>
> when up the snort this message :
>
> [root@afrodita snort]# /etc/rc.d/init.d/snort start
> Starting snort ...[root@afrodita snort]# Log directory
> = /var/log/snort
>
>         --== Initializing Snort ==--
>
> Initializing Network Interface eth0
> Decoding Ethernet on interface eth0
> Parsing Rules file /opt/snort/snort.conf
> No arguments to frag2 directive, setting defaults to:
>     Fragment timeout: 60 seconds
>     Fragment memory cap: 4194304 bytes
> Stream4 config:
>     Stateful inspection: ACTIVE
>     Session statistics: INACTIVE
>     Session timeout: 30 seconds
>     Session memory cap: 8388608 bytes
>     State alerts: INACTIVE
>     Scan alerts: ACTIVE
>     Log Flushed Streams: INACTIVE
> No arguments to stream4_reassemble, setting defaults:
>      Reassemble client: ACTIVE
>      Reassemble server: INACTIVE
>      Reassemble ports: 21 23 25 53 80 143 110 111 513
>      Reassembly alerts: ACTIVE
> WARNING: command line overrides rules file alert
> plugin!
>
>         --== Initialization Complete ==--
>
>
> snort.conf have the line
>
> output database: alert, mysql, user=snort
> password=snort  dbname=snort host=localhost


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users