[Snort-devel] variable substitution in ruletype definition

Martin Roesch roesch at ...48...
Thu Apr 5 14:24:48 EDT 2001


This doesn't work?  I guess it probably wouldn't if the parser isn't
taking it into account, but I thought this was automatically done in
ParsePreprocessor()?

Nope, it's not.  I just committed code to CVS that will do variable
substitution for the syslog output plugin...


    -Marty

Phil Wood wrote:
> 
> I guess it does not work at this time.  would it be reasonable to allow:
> 
>   output alert_syslog: $SYSFACILITY $SYSPRIORITY $SYSOPTIONS
> 
> when the three variables have been defined previously?
> 
> Thanks,
> 
> Phil
> 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> http://lists.sourceforge.net/lists/listinfo/snort-devel




More information about the Snort-devel mailing list