[Snort-users] log

Saragoth nntk saragoth at ...131...
Tue May 15 10:53:11 EDT 2001


I have defined this in snort.conf

output alert_full: filename
output alert_fast: filename
output log_tcpdump: filename

I start snort with:
/usr/local/bin/snort -D -c /etc/snort.conf -i eth1 -l
/var/log/snort


It logs to the 3 specified files, but i am still
getting this in syslog:

May 15 08:46:22 hostname snort: LOG: spp_portscan:
PORTSCAN DETECTED from xxx.xxx.xxx.xxx (THRESHOLD 4
connections exceeded in 3 seconds) 
May 15 08:46:26 hostname snort: LOG: spp_portscan:
portscan status from xxx.xxx.xxx.xxx: 10 connections
across 4 hosts: TCP(0), UDP(10) 
May 15 08:46:33 hostname snort: LOG: spp_portscan:
portscan status from xxx.xxx.xxx.xxx: 4 connections
across 2 hosts: TCP(0), UDP(4) 
May 15 08:46:40 hostname snort: LOG: spp_portscan: End
of portscan from xxx.xxx.xxx.xxx: TOTAL time(7s)
hosts(5) TCP(0) UDP(14) 

Any idea how i stop that logging into syslog ?

Regards Sg

__________________________________________________
Do You Yahoo!?
Yahoo! Auctions - buy the things you want at great prices
http://auctions.yahoo.com/




More information about the Snort-users mailing list