Snort mailing list archives
Can't read data_log output file (empty)
From: Ronin CS via Snort-devel <snort-devel () lists snort org>
Date: Mon, 17 Jul 2017 19:20:22 -0300
Hello everyone, I'm trying to better understand how to handle events inside Snort++ using data_log inspector as example. But at the moment, I can't really read the output file because it's always empty for me. Until now, I did the following changes to snort.lua: - Added a new line "data_log = { key = 'http_raw_uri' } - Changed the "http_inspector = { }" to "http_server = { }" (As recommended here: http://marc.info/?l=snort-users&m=147422221322032&w=2) And ran the command: "sudo snort -c /opt/snort/etc/snort/snort.lua -R /opt/snort/etc/snort/samples.rules -r http.cap -A alert_ex --plugin-path /opt/snort/lib/snort_extra" The http.cap I'm using is the one located at https://wiki.wireshark.org/ SampleCaptures What am I missing here? Thanks in advance, Ronin.
_______________________________________________ Snort-devel mailing list Snort-devel () lists snort org https://lists.snort.org/mailman/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Can't read data_log output file (empty) Ronin CS via Snort-devel (Jul 17)
- Re: Can't read data_log output file (empty) Russ via Snort-devel (Jul 17)
- Re: Can't read data_log output file (empty) Lawrence Belyeu via Snort-devel (Jul 17)
- Re: Can't read data_log output file (empty) Ronin CS via Snort-devel (Jul 19)
- Re: Can't read data_log output file (empty) Russ via Snort-devel (Aug 03)
- Re: Can't read data_log output file (empty) Ronin CS via Snort-devel (Aug 03)
- Re: Can't read data_log output file (empty) Russ via Snort-devel (Jul 17)