[Snort-users] MISC IP Reserved bit set

Martin Roesch roesch at ...1935...
Sun Oct 14 20:44:02 EDT 2001


> PS .. how do i figure out why the snort alerts are not getting into my
> mysql database even when i have the following line in the snort.conf?
> 
> # database: log to a variety of databases
> # See the README.database file for more information about configuring
>  output database: log, mysql, user=user dbname=snort host=localhost

Set it to 

output database: alert, mysql, user=user dbname=snort host=localhost
                 ^^^^^

> when i do a process listing in mysql it seems that snort  is no longer
> logged in from localhost after some time elapses.

Dunno about that one, ask Jed/Roman...

> Also has anyone figured out how to get portscans into the database?

As above.


     -Marty

--
Martin Roesch - President, Sourcefire Inc. - (410)552-6999
roesch at ...1935... - http://www.sourcefire.com  
Snort: Open Source Network IDS - http://www.snort.org




More information about the Snort-users mailing list