[Snort-users] Can snort send alerts to the mysql database without writing an output file?
Jacob, Raymond A Jr
raymond.jacob at ...7622...
Wed Mar 8 13:14:03 EST 2006
Question: Can snort send alerts to the mysql database without writing an output file?
ids# ./snort.sh start
/usr/local/bin/snort -Dq -dev -o -A none -K none -c /usr/local/etc/snort/snort.conf -i mi0 -u user -g group
relevant portion of snort.conf
ids# sed -n '/^output/p' /usr/local/etc/snort/snort.conf
output database: log, mysql, user=user dbname=ids password=xxxx host=loca
output database: log, mysql, user=user dbname=ids_archive password=xxxx h
When I run the above command line, I get no alerts.
When I run the above command line without -A none and -K none I get alerts sent to ids database
i.e./usr/local/bin/snort -Dq -dev -o -c /usr/local/etc/snort/snort.conf -i mi0 -u user -g group
When I run with the -A none I get the pcap files but no alerts sent to ids database.
Someone said try the -Y option that did not work in 2.4.3.
Thank you for your help,
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users