Snort mailing list archives
Re: alerts with date of 1969
From: Nick White <spacemky () gmail com>
Date: Tue, 19 Oct 2004 14:11:07 -0700
On Tue, 19 Oct 2004 15:49:08 -0400, Matt Kettler <mkettler () evi-inc com> wrote:
At 01:19 PM 10/19/2004, Nick White wrote:I'm running snort 2.2.0 on FreeBSD 5.2.1-RELEASE on sparc64 hardware. Every time an alert gets logged, the date is from 1969. I've checked the date from the server, and everything seems ok: # date Tue Oct 19 10:16:09 PDT 2004What kind of alert logging are you using? sql? syslog? fast? full? unified? unix socket? The time output for each of these is implemented a bit differently. fast and full both seem to use ts_print() from util.c. Database outputs seem to use GetTimestamp() from plugbase.c Unified seems to dump it in raw binary. Syslog seems to not bother, relying on syslogd to add it.
I'm using: output database: alert, mysql, log_null, user=snort dbname=snort host=localhost So what are my options in getting the 1969 thing fixed? I've seen a lot of theory and this and that, but no specific things I could try. Thanks, nw ------------------------------------------------------- This SF.net email is sponsored by: IT Product Guide on ITManagersJournal Use IT products in your business? Tell us what you think of them. Give us Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more http://productguide.itmanagersjournal.com/guidepromo.tmpl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- alerts with date of 1969 Nick White (Oct 19)
- Re: alerts with date of 1969 Matt Kettler (Oct 19)
- Re: alerts with date of 1969 Nick White (Oct 19)
- Re: alerts with date of 1969 Matt Kettler (Oct 19)