[Snort-users] spp_anomsensor: Anomaly threshold exceeded in a lert.log

Erek Adams erek at ...577...
Mon Sep 9 07:28:03 EDT 2002


On Mon, 9 Sep 2002 francisv at ...6732... wrote:

> How do I turn off alert logging in /var/log/snort/alert and divert
> everything to MySQL?

As I said in my other message start Snort with the '-N' parameter.  Check out
the inline help from Snort--It's got some useful things listed.  :)

> -----Original Message-----
> From: Erek Adams [mailto:erek at ...577...]
> Sent: Monday, September 09, 2002 5:50 PM
> To: francisv at ...6732...
> Cc: snort-users at lists.sourceforge.net
> Subject: Re: [Snort-users] spp_anomsensor: Anomaly threshold exceeded in
> alert.log
>
> On Mon, 9 Sep 2002 francisv at ...6732... wrote:
>
> > I'm logging all alerts to MySQL but why is Snort producing
> > /var/log/snort/alert? Here's the content (and continuously growing):
> >
> > [**] [104:1:1] spp_anomsensor: Anomaly threshold exceeded: 13.3085 [**]
> > 09/09-14:29:10.585623 195.159.0.151:40167 -> 202.91.161.5:8081
> > TCP TTL:49 TOS:0x20 ID:49962 IpLen:20 DgmLen:60 DF
> > ******S* Seq: 0xF030EEA5  Ack: 0x0  Win: 0x16D0  TcpLen: 40
> > TCP Options (5) => MSS: 1460 SackOK TS: 2591895224 0 NOP WS: 0
>
> Use 'snort -N <other options>'.
>
> [...]
>
> [erek at ...3978...]/var/log/snort#snort -\?
> Initializing Output Plugins!
>
> -*> Snort! <*-
> Version 1.9.0beta6 (Build 202)
> By Martin Roesch (roesch at ...1935..., www.snort.org)
> USAGE: snort [-options] <filter options>
> Options:
>
> [...snip...]
>         -N         Turn off logging (alerts still work)
> [...snip...]
>
> -----
> Erek Adams
> Nifty-Type-Guy
> TheAdamsFamily.Net
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by: OSDN - Tired of that same old
> cell phone?  Get a new here for FREE!
> https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net





More information about the Snort-users mailing list