On Sat, 30 Oct 2004 10:32:02 -0700, Steven Crandell
<steven.crandell@gmail.com> wrote:
Hi all,
I'm sure I'm just missing the doc that tells me how to do this, but
try as I might, I can't find it.
I'm trying to find a way to get the alerts generated by this line in
my snort.conf
"preprocessor portscan: xxx.xxx.xxx.xxx/24 5 7 /var/log/snort/alert"
to log to the database in addition to the file specified.
I'm also wondering about the flow-portscan preprocessor output.
I have: "output-mode msg"
but does this mean that anything that the flow-portscan detects goes
to the db or some other place?
It may be worth noting that I have these two lines in my conf also.
output alert_fast: alert
output database: log, mysql, user=<dbuser> password=<pass> dbname=<db>
host=localhost
I'm not sure if one or the other of them becomes a default output
method or something. Any recommendations would be greatly
appreciated.
thanks,
You are not mentioning what frontend you are using, but standard ACID
or plain snort doesn't store them in database. The only front-end know
of that stores portscan and session statistics in DB is Sguil
(www.sguil.net, and it's actually much more then just a front-end).
Disclaimer: I am listed as a developer at the sguil project
Best regards
Michael Boman
-------------------------------------------------------
This SF.Net email is sponsored by:
Sybase ASE Linux Express Edition - download now for FREE
LinuxWorld Reader's Choice Award Winner for best database on Linux.
http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
