Re: Logging a specific IP to a separate logging instance

[Erek Adams <erek () snort org>]

On Thu, 6 Feb 2003, A Fubbick wrote:

> I'd like to be able to log every signature match for a specific IP to a
> separate log instance. How do I do this without having to write separate
> rules for this IP?

Use "logto" [0].  You'll have to edit each and every rule, but sed is your
friend.  :)  You'll also need to redefine $HOME_NET as that single IP.

You might want to consider running a post process Snort for that.  Use one
to handle everything as normal, then have a second config that you run
over the data file once you're done.

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


[0]     http://www.snort.org/docs/writing_rules/chap2.html#tth_sEc2.3.2


-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users