[Snort-users] Snort and SQL logging

John Sage jsage at ...2022...
Fri Sep 13 05:53:04 EDT 2002


On Fri, Sep 13, 2002 at 08:28:34AM +0800, francisv at ...6732... wrote:
> Hi all,
> 
> Does your snort log /var/log/snort/alert even if you log the alerts on a SQL
> database?

Yes.

In my snort.conf for snort 1.8.7, I do both:

<snip>
# -------------------------------------------------
# output alert_full
output alert_full: /var/log/snort/alert187.full
# keep as from 1.8.4

<snip>

# output database: log, mysql, user=root password=test dbname=db
#   host=localhost
output database: alert, mysql, user=toot password=p4ssw0rd \
  dbname=snort host=[host_name] encoding=hex detail=full
# keep as from 1.8.4
<snip>



- John
-- 
"Obviously, we do not want to leave zombies around."

PGP key:     http://www.finchhaven.com/pages/gpg_pubkey.html
Fingerprint: C493 9F26 05A9 6497 9800  4EF6 5FC8 F23D 35A4 F705




More information about the Snort-users mailing list