[Snort-users] Snort, ACID and portscan.log
crcook at ...6518...
Fri Aug 9 14:06:01 EDT 2002
the alerts DO make it to the database. But if you click on the IP
address that gives you the portscan information, and then click
"portscan events" it wants a separate log file, it is unable to
reference the file because the file is stored on the snort box itself.
I have to physically copy the file (called portscan.log) which logs the
actual events. It has been suggested to change the output database to
log, but then I'll lose the alerts. Am I allowed to have one output do
logs and another do alerts?
The reason for the question is that snort did come up with portscan
events. I went to click on the "portscan events" link and it came back
with "cannot find $portscan_file" I went back to the snort box,
transfered this one file, and it then worked, and I was able to put
together that it was a portscan attack. Though I don't want to have to
copy this file everytime. If snort can do it, cool. If not, then I may
have to set up a batch file to do it for me.
Security and Support Specialist
Office of Information Technology
Dan Fiorito wrote:
>Your DB Output plugin should be changed to alert instead of log. Then it should work, do note that acid considers all portscans as different alerts so if you are on a busy network you will have a lot of alerts to sort through.
> -----Original Message-----
> From: Christopher Cook [mailto:crcook at ...6518...]
> Sent: Fri 8/9/2002 11:45 AM
> To: snort-users at lists.sourceforge.net
> Subject: [Snort-users] Snort, ACID and portscan.log
> I currently have Snort running on one box and doing all the spiffy mySQL
> logging to another centrally located machine. It's set to log alerts
> and does that just fine. Snort is set to log portscans and send them to
> a portscan file locally to the snort box. I didn't see any options in
> Snort to send the portscan file to the remote log server so that ACID
> can access it. Is there a way to send the file to the remote log server
> through Snort, or do I need to set a job to do it every night or so?
> Chris Cook
> Security and Support Specialist
> Office of Information Technology
> Oakland University
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> Snort-users list archive:
More information about the Snort-users