Snort mailing list archives

modifying 5snort to add more detail to email


From: "Kretzer, Jason R (Big Sandy)" <jason.kretzer () kctcs edu>
Date: Wed, 9 Nov 2005 11:18:33 -0500

Hello all,
 
I am using snort on Debian sarge.  Debian comes with a cron.daily script
called 5snort.  This log handles emailing a report on the snort alerts.
Sometimes the report lists several events but does not give any details.
Does anyone know how to set this to where it will report EVERY entry in
the alert log?  Below I have pasted a sample of one of the "no detail"
emails.
 
Thanks,
 
-Jason
 
 
 
 
 
 
 Events between  10 30 09:51:50  and  10 30 09:51:50
Total events: 1
Signatures recorded: 1
Source IP recorded: 1
Destination IP recorded: 1


Events from same host to same destination using same method
========================================================================
=
 # of  from             to               method
========================================================================
=


Percentage and number of events from a host to a destination
============================================================
 %    # of  from             to
============================================================


Percentage and number of events from one host to any with same method
==============================================================
 %    # of  from             method
==============================================================


Percentage and number of events to one certain host
=================================================================
 %    # of  to               method
=================================================================


The distribution of event methods
===============================================
 %    # of  method
=============================================== 

Current thread: