[Snort-users] Why the alert # in the snort final stat do not match the alert # in log?
Lin.Zhong at ...11426...
Wed May 26 13:11:08 EDT 2004
Hi, Can anybody help me with this problem?
I have defined my own version of alert_CSV, but when I examine the alert file generate and snort's final statistic output. I say a gap between the alert # in the alert file (491 alerts )and that shown in snort final stat output(494 alerts and 494 logged).
I wonder what cause this gap.
Could the 3 misery alerts be the alerts for the preprocessors. I saw the snort STERR output and find
I wonder whether these three alerts for for alert_large_fragments, alert_incomplete or alert_multiple_requests.
But I don't know where these alerts go to... I couldn't find them in my log file.
Thank you very much
More information about the Snort-users