Re: HOW DOES ONE STOP an alert file from being Produced?

[Dirk Geschke <Dirk_Geschke () genua de>]

Hi Marty,

> > To turn off alerting, use "-A none" at the command line.  To turn off  
> > logging, you can use -N at the command line or add a "output  
> > log_null" in the snort.conf file.
>
> yes, but "-A none" will also disable all output plugins. This is sometimes
> not desired...

I have to correct myself... If an output plugin for "alert" is activated then 
no alert file is written. If someone is only interested in "log" messages 
like with the database output plugin then a "-A none" should do the work
since one is not interested in the alert functions. (Most of the time both 
are called, AlertFuncs and LogFuncs.)

To summarize:

 + if an output plugin is activated it is used.
 
 + if no output plugin is specified the default is used (-> files
   in /var/log/snort)

 + there are two different facilities: "log" and "alert". These are
   most of the time the same, some preprocessors use only "alert" and
   "Tagged packets" via "tag" keyword are only forwarded to "log".

Sorry, but it took some time to realize that...

Best regards

Dirk 



-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users