Re: Diff between max_queue and log (README.event_queue)

["Nicholas Mavis (nmavis)" <nmavis () cisco com>]

Your understanding is correct, you can also specify the order_events flag to determine the way incoming events are 
ordered.

Nick

From: Balasubramaniam Natarajan <bala150985 () gmail com<mailto:bala150985 () gmail com>>
Date: Thursday, March 27, 2014 at 12:54 PM
To: "snort-users () lists sourceforge net<mailto:snort-users () lists sourceforge net>" <snort-users () lists 
sourceforge net<mailto:snort-users () lists sourceforge net>>
Subject: [Snort-users] Diff between max_queue and log (README.event_queue)

HI

Could some one please explain the difference between max_queue and log ?  I don't understand what is ment by "only 8 
events will be stored for a single packet or stream".  So if we have 8 defined for max_queue and 3 for log would that 
mean snort will log just 3 out of the 8 events which got triggered for that packet/stream ?

https://github.com/jasonish/snort/blob/master/doc/README.event_queue


max_queue


----------

This determines the maximum size of the event queue.  For example, if the
event queue has a max size of 8, only 8 events will be stored for a single
packet or stream.

The default value is 8.

log


---

This determines the number of events to log for a given packet or stream.
You can't log more than the max_event number that was specified.

The default value is 3.


--
Regards,
Balasubramaniam Natarajan
www.blog.etutorshop.com<http://www.blog.etutorshop.com>

------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!