Snort mailing list archives
Issues in changing max_queue_events value
From: Navdeep Uniyal <Navdeep.Uniyal () neclab eu>
Date: Tue, 30 May 2017 15:42:46 +0000
Dear Users,
I have been trying to experiment with 200 alerts for snort. But the issue is while I am increasing the max_queue_events
value to 300, it is getting default to 100.
As per snort output....
Action Stats:
Alerts: 100 (9998.500%)
Logged: 100 (9998.500%)
Passed: 0 ( 0.000%)
Limits:
Match: 100
Queue: 0
Log: 0
Event: 0
Alert: 0
Which means that it is alerting for 100 rules, whereas other 100 rules are matching but are ignored. As per snort
manual, max_queue_events handle this factor, which I am already changing. Please if you could help me in this regard.
PFA the snort file.
Best Regards,
Navdeep
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Issues in changing max_queue_events value Navdeep Uniyal (May 30)
- Re: Issues in changing max_queue_events value Russ (Jun 01)
