Re: get rid of /var/log/snort/alert

[Dirk Geschke <dirk () geschke-online de>]

Hi,

> I have configured two output plugins in snort.conf:
> output database: log, postgresql [...]
> output log_tcpdump: [...]
>
> I am starting snort as follows:
> snort -c /etc/snort/snort.conf -D -u _snort -g _snort -i bridge0
>
> But after starting snort I get also /var/log/snort/alert
> in ascii fast format (if I'm correct).
>
> How to get rid of it?
>
> I can get rid of it running snort as:
> snort -c /etc/snort/snort.conf -A none -D -u _snort -g _snort -i bridge0
> but then snort doesn't log to database.
>
> Ideas?:)

yes, some time ago I wrote a patch for this problem. It is now part of
the FLoP (http://www.geschke-online.de/FLoP/) patch to snort. This patch
adds the option -Y which works like -N but for alerts. Thus the default
is - if -Y is used - to write nothing to the disk but only to the
defined output plugins of snort.conf.

I asked to add this patch to snort but up to now I got no response.
Maybe I can extract this part from the patch if someone is interested
in it. 

But since you use PostgreSQL as output plugin you maybe are interested
in FLoP at all? It is a replacement for the database output plugin
similar to barnyard but it does the database handling on a central
server and not on the machine running snort.

Best regards

Dirk


-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.  Get Certified Today
Register for a JBoss Training Course.  Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users