SNORT configuration: logging alerts without portscans

[Thomas.Klockow () cert siemens de]

Hi *,

I wonder if it is possible to log portscans and alerts to different files.

So portscans should go only(!) to the file specified with the portscan
keyword (preprocessor portscan: 192.168.1.0/24 5 7 /var/log/portscan.log)
and alerts should go only to where ever you want, syslog for example (output
alert_syslog: LOG_AUTH LOG_ALERT).

In my standard configuration the portscans are logged in both files, what is
not my intention.
Any help?

        Thomas

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users