[Snort-users] Logs and alerts directed into a single file?

Sconeboy The Magnificent sconeboy at ...11827...
Tue Sep 7 10:31:51 EDT 2004


Hi there,

I assume i am doing something wrong, but i cannot see a way to get
snort to log alerts and 'log' to one and the same file,

for example, i have a rule to diagnose http data across my network
using the session:printable; parameter [F1]. if i use an 'alert' rule
in my snort rules file it will log to alert for that rule to one file,
and then the actual payload data to another file [F2]

is it possible to log the alert and then the data immedietly after in one file? 

[F1]

alert tcp any 80 <> 192.168.1.0/24 any (msg:"http user";
flow:from_server,established; logto:"alert";content:"POST ";
session:printable;)

[F2]

$ ls -al ../192.168.1.100/
drwx------    1 root     root            0 Jan  1 02:31 .
drwxr-xr-x    1 root     root            0 Jan  1 01:34 ..
-rw-------    1 root     root          281 Jan  1 02:31 PROTO006:4851-80
-rw-------    1 root     root          661 Jan  1 02:31 SESSION:4851-80
-rw-------    1 root     root          661 Jan  1 02:43 SESSION:4872-80
$

[PROTO006 is the alert, SESSION: is the data]

Thank you,
Rory




More information about the Snort-users mailing list