[Snort-users] spp_anomsensor: Anomaly threshold exceeded in a lert.log

francisv at ...6732... francisv at ...6732...
Mon Sep 9 03:49:02 EDT 2002


Hi Erek,

How do I turn off alert logging in /var/log/snort/alert and divert
everything to MySQL?

-----Original Message-----
From: Erek Adams [mailto:erek at ...577...] 
Sent: Monday, September 09, 2002 5:50 PM
To: francisv at ...6732...
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] spp_anomsensor: Anomaly threshold exceeded in
alert.log

On Mon, 9 Sep 2002 francisv at ...6732... wrote:

> I'm logging all alerts to MySQL but why is Snort producing
> /var/log/snort/alert? Here's the content (and continuously growing):
>
> [**] [104:1:1] spp_anomsensor: Anomaly threshold exceeded: 13.3085 [**]
> 09/09-14:29:10.585623 195.159.0.151:40167 -> 202.91.161.5:8081
> TCP TTL:49 TOS:0x20 ID:49962 IpLen:20 DgmLen:60 DF
> ******S* Seq: 0xF030EEA5  Ack: 0x0  Win: 0x16D0  TcpLen: 40
> TCP Options (5) => MSS: 1460 SackOK TS: 2591895224 0 NOP WS: 0

Use 'snort -N <other options>'.

[...]

[erek at ...3978...]/var/log/snort#snort -\?
Initializing Output Plugins!

-*> Snort! <*-
Version 1.9.0beta6 (Build 202)
By Martin Roesch (roesch at ...1935..., www.snort.org)
USAGE: snort [-options] <filter options>
Options:

[...snip...]
        -N         Turn off logging (alerts still work)
[...snip...]

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net




More information about the Snort-users mailing list