[Snort-users] Snort Event Ids on win2000

Michael Steele michaels at ...9077...
Tue May 27 20:20:04 EDT 2003


Not real sure what you're trying to do here. If you have Snort configured to
log to Syslog then you will only get a single line of text from the actual

Logging to Syslog is generally used for Emailing alerts based on a specific
pattern. You can use ACID or Snortsnarf to view the complete alert, but you
will need to setup a Viewer like ACID or Snortsnarf (there are others).

The actual alert.ids file (Snort log) can be found in the /log folder where
you specified the -l in your run line.


-Michael Steele
 System Engineer / Security Support Technician     
 mailto:michaels at ...9077...    
 Website: http://www.winsnort.com
 Snort: Open Source Network IDS - http://www.snort.org

-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of C Wells
Sent: Tuesday, May 27, 2003 5:10 PM
To: 'snort-users at lists.sourceforge.net'
Subject: [Snort-users] Snort Event Ids on win2000

Is there documentation of the Snort Event Ids that one
could find in the Application Event Log of Windows
2000 ? If Snort doesn't write to the Event log on
win2000 where might I find 'log' type information ? 


Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.

This SF.net email is sponsored by: ObjectStore.
If flattening out C++ or Java code to make your application fit in a
relational database is painful, don't do it! Check out ObjectStore.
Now part of Progress Software. http://www.objectstore.net/sourceforge
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list