[Snort-users] Portscan not logging

Mike Macias mike.macias at ...5336...
Tue May 28 05:37:03 EDT 2002


> output database: alert, mysql, user=snort password=***** dbname=snort 
> host=localhost
> ~and~
> preprocessor portscan: $HOME_NET 4 3 portscan.log

> Should the second line be changed to log them to the database as well or 
> should portscan detections go to the database based on the first line?
> 

Nope.  It should go to your DB with just alert on.
Is your site busy?  How long have you been running it in this config. 
without seeing any results?





More information about the Snort-users mailing list