Re: Not getting alerts in "alert" file.

[waldo kitty <wkitty42 () windstream net>]

On 4/30/2013 14:14, Shields, Joseph (NIH/NIEHS) [C] wrote:
> Hi. I am not sure if my running two snort processes (each monitoring a different
> network interface) is causing the alerts to NOT show up in the alert file?

each snort instance needs its own set of config and logging files... are you 
trying to share the same logging files?

i would create /var/log/snort1 for the first instance and /var/log/snort2 for 
the second instance... i this way, each has its own alert and 
snort.log.xxxxxxxxxxxxxx files... i would also probably take the easy way out 
and use /etc/snort1.conf and /etc/snort2.conf but i'm sure that it is possible 
to use one config that has the main stuff that is all the same and then include 
different files that have the specifics for each instance... i would likely 
differentiate between them by setting and using environment variables...

eg: in the first instance's startup script
        EXPORT whichsnort=snort1

     in the second instance's startup script
        EXPORT whichsnort=snort2

     and in the script it would have %whichsnort so the config would use 
something like

   include /path/%whichsnort-vars.conf

i'm not where i can pull any actual working examples depicting this so i can 
only hope that i'm stating this in such a way as to light the lightbulb for 
you... the overall easiest way is to use completely separate confs, though... 
just make sure you edit the proper one and include any changes in both if you 
have to...


-- 
NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.

------------------------------------------------------------------------------
Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
Get 100% visibility into your production application - at no cost.
Code-level diagnostics for performance bottlenecks with <2% overhead
Download for free and get started troubleshooting in minutes.
http://p.sf.net/sfu/appdyn_d2d_ap1
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!