Snort mailing list archives
Re: Output Plugins
From: Jose Maria Lopez <jkerouac () bgsec com>
Date: 10 Sep 2004 18:38:01 +0200
El jue, 09 de 09 de 2004 a las 22:01, Eric Kahklen escribió:
I am trying to setup my 1st snort box and was going through the snort.conf. I am going to be using ACID with mysql. From the docs, it says you can either use log or alert. The example they include is: output database: log, mysql, user=root password=test dbname=db host=localhost Is it better to use log vs. alert? Does that mean that mysql will only capture data that triggers rules written with the log action event?
I'v always used log and it logs all the rules with the alert action event.
Also, is there a way to point all snort logging period to go to one directory vs. being put into my messages directory? Thanks, Eric
-- Jose Maria Lopez Hernandez Director Tecnico de bgSEC jkerouac () bgsec com bgSEC Seguridad y Consultoria de Sistemas Informaticos http://www.bgsec.com ESPAÑA The only people for me are the mad ones -- the ones who are mad to live, mad to talk, mad to be saved, desirous of everything at the same time, the ones who never yawn or say a commonplace thing, but burn, burn, burn like fabulous yellow Roman candles. -- Jack Kerouac, "On the Road" ------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement on who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Output Plugins Eric Kahklen (Sep 09)
- Re: Output Plugins Jose Maria Lopez (Sep 10)