[Snort-users] Re: [Snort-users] Can snort send alerts to the mysql database without writing an output file?

Nerijus Krukauskas nkrukauskas at ...11827...
Thu Mar 9 03:48:01 EST 2006


On 09/03/06, Dirk Geschke <Dirk_Geschke at ...1344...> wrote:
> Hi Nerijus,
>
> > > Well, yeah!
> > > This is bug in snort, but seems that this doesn't
> > > bother devs.
> > >
> > > Read this once more - more carefully:
> > > https://marc.theaimsgroup.com/?l=snort-users&m=114177073012250&w=2
> >
> >  '-K none' and appropriate config line for db (_only_) in snort.conf
>
> '-K none' does only affect logging, not the alerts...

 In my snort.conf I have only one output plugin configured. And that
is database. On a command line I have: 'snort -K none -o -e -c
<my_snort.conf_with_only_db_output_plugin> -X -d -y -D -i
<interface_to_sniff>'. This combination works like charm. I have an
empty /var/log/snort dir and alerts go right into the database. Isn't
this what the OP wanted? (Can't figure it out now, cause the whole
thread is messed all around my gmail.) Snort version is 2.4.3 (if that
matters) running on linux.

> BTW: This is the same as option '-N'.

  Yes, '-N' == '-K none'.

> >   Your turn: http://www.theadamsfamily.net/~erek/snort/drinking_game.txt
>
> You spent the drinks? Fine, when and where?

  Only for you, Dirk. And only if you come to my city. :) Deal? :)

--
http://nk99.org/




More information about the Snort-users mailing list