[Snort-users] logfile problem

Dino no.sec at ...1877...
Mon May 10 07:23:32 EDT 2004


hi guys!

this thing is drivin' me crazy. finally i installed snort and the 
snortsam-plugin and it seems everything is running fine. i still have 
some problems with the logfiles. snort keeps sending the alerts to the 
/var/log/syslog. now, is it possible to have the alerts also in a file, 
let's say /var/log/snort/alerts.log? i googled, i searched but nothin'. 
i finally realized i'm probably to ignorant..so i need your help!

this is the output i get in the syslog:

15:40 windino snort: [1:1420:3] SNMP trap tcp [Classification: Attempted 
Information Leak] [Priority: 2]: {TCP} 192.xxx.xxx.xxx:58705 -> 
192.xxx.xxx.xxx:162


but i'd like something like that in my alert.log file:

[**] [1:620:6] SCAN Proxy Port 8080 attempt [**]
[Classification: Attempted Information Leak] [Priority: 2]
05/04-18:06:46.093567 192.xxx.xxx.xxx:40021 -> 192.xxx.xxx.xxx:8080
TCP TTL:64 TOS:0x0 ID:8501 IpLen:20 DgmLen:60 DF
******S* Seq: 0xF05C88E4  Ack: 0x0  Win: 0x16D0  TcpLen: 40
TCP Options (5) => MSS: 1460 SackOK TS: 354855377 0 NOP WS: 0

i know, it's probably just 1 or 2 lines in the snort.conf. i tried 
several output-plugins, but anything worked.
so, any help is apreciated!

cu
Dino

P.S. slack 9.1/2.4.24





More information about the Snort-users mailing list