Hi Marty,
To turn off alerting, use "-A none" at the command line. To turn off
logging, you can use -N at the command line or add a "output
log_null" in the snort.conf file.
yes, but "-A none" will also disable all output plugins. This is sometimes
not desired...
I have to correct myself... If an output plugin for "alert" is activated then
no alert file is written. If someone is only interested in "log" messages
like with the database output plugin then a "-A none" should do the work
since one is not interested in the alert functions. (Most of the time both
are called, AlertFuncs and LogFuncs.)
To summarize:
+ if an output plugin is activated it is used.
+ if no output plugin is specified the default is used (-> files
in /var/log/snort)
+ there are two different facilities: "log" and "alert". These are
most of the time the same, some preprocessors use only "alert" and
"Tagged packets" via "tag" keyword are only forwarded to "log".
Sorry, but it took some time to realize that...
Best regards
Dirk
-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
