lmarcilly@aressi.fr wrote:
Hi all,
i have difficulties to understand what informations are logged and
how they are logged...
At the beginning, i've used the output alert_unified of snort, so it
create the snort.alert file and a lot of directories (for example
192.168.1.100, 192.168.1.5, 255.255.255.255) I just add that i use
three rules in order to test the output :
alert_unified does not create directories. -A (alert_fast) will create
what you describing IIRC. alert_unified should only create a single file
with all of the alerts in it.
FYI: command line options override config file settings.
alert tcp any any -> any any (msg:"tcp snort";) alert udp any any ->
any any (msg:"udp snort";) alert icmp any any -> any any (msg:"icp
snort";)
I hope this is only testing. That would be an insane use of the snort
alerting capabilities.
So i think that snort.alert contain alert informations and the
directoris other log information, am i wrong?
close enough.
Now, i use output alert unified and log_unified, so i have one
snort.alert file and one snort.log file. I want to know if
informations in the snort.log are the same as in directories?
information in the .log file is actual packet data and alert
information. The .alert file is just alert information.
And what about barnyard using files? Does it log the same thing in
the two situation? Or does it log more information with the
directories?
It is the same information in a more usable format for automated
processing. unified.log files are essentially alert headers with a pcap
wrapped into a nice record format.
-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
