ruletype doesn't work at all ?!

["chlang" <chlang () mail techman com tw>]

I tried to do the ruletype inside the snort.conf hoping to get more actions
in response.
"icmp destination not reachable" is not what I will react when it occurs,
just a log/alert is needed, so is "Login Incorrect"
but a backdoor attack must raise a redalert, that send a mail or a winpopup
to me....

but enabling ruletype doesn't work for me, here is what I do:

inside snort.conf
ruletype redalert
{
  type alert
  output alert_syslog: LOG_AUTH LOG_ALERT
  output database: log, mysql, user=snort dbname=snort host=localhost
  output alert_smb: winhost.lst
}
and have a test rule inside local-lib:
redalert tcp any any -> any any (msg:"red-alert, test1"; content:"redtest1")

get nothing to my syslog, database, or any popup.
but it is working if I don't use any ruletype at all.

Did I forget something ? compile option ?
Thanks in advanced.

chlang () kimo com


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users