output config

[Laszlo Toth <laszlo.toth () linguamatics com>]

Hi,

I'm  trying  to change the way how snort logs the alerts but it looks 
like my changes are being ignored.

The corresponding entries in snort.conf:
output alert_unified2: filename alert, limit 12800, nostamp
output alert_unified2: filename alert_test, limit 5, nostamp

The  result  is  still  the default behaviour. Alert is rotated after 
128MB written and nothing is logged to alert_test.

The snort command is /usr/sbin/snort -A fast -b -d -D -i br0 -u snort -g snort -c /etc/snort/snort.conf -l 
/var/log/snort

What am I missing?

Thanks,
Laszlo


------------------------------------------------------------------------------
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!