Diff between max_queue and log (README.event_queue)

[Balasubramaniam Natarajan <bala150985 () gmail com>]

HI

Could some one please explain the difference between max_queue and log ?  I
don't understand what is ment by "only 8 events will be stored for a single
packet or stream".  So if we have 8 defined for max_queue and 3 for log
would that mean snort will log just 3 out of the 8 events which got
triggered for that packet/stream ?

https://github.com/jasonish/snort/blob/master/doc/README.event_queue

max_queue

----------

This determines the maximum size of the event queue.  For example, if the
event queue has a max size of 8, only 8 events will be stored for a single
packet or stream.

The default value is 8.

log

---

This determines the number of events to log for a given packet or stream.
You can't log more than the max_event number that was specified.

The default value is 3.



-- 
Regards,
Balasubramaniam Natarajan
www.blog.etutorshop.com

------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!