[Snort-users] Nimda specific logging
subba9 at ...530...
Wed Oct 10 13:44:13 EDT 2001
I am trying to log Nimda specific traffic to a file "nimda.log".
In snort.conf, I have defined a new ruletype, which is as follows:
output alert_fast: nimda.log
In my "nimda.rules" file, the rule syntax is as follows:
nimda tcp $EXTERNAL_NET 80 -> $HOME_NET any (.......)
With this new ruletype, I do not see any nimda specific logging going
into the "nimda.log". When I run SnortSnarf on the existing "alert" file,
their is mention of the "nimda.rules file" to some alerts.
Could someone point out what I am missing for this new ruletype?
Thank you in advance.
subba9 at ...530... http://members.home.net/subba9/
OpenPGP/GPG public key ID CCB7344E
=> Time is relative. Here is a new way to look at time. <=
More information about the Snort-users