[Snort-users] HOW DOES ONE STOP an alert file from being Produced?

Dirk Geschke Dirk_Geschke at ...1344...
Thu Mar 9 07:57:01 EST 2006


Hi Marty,

> > To turn off alerting, use "-A none" at the command line.  To turn off  
> > logging, you can use -N at the command line or add a "output  
> > log_null" in the snort.conf file.
> 
> yes, but "-A none" will also disable all output plugins. This is sometimes
> not desired...

I have to correct myself... If an output plugin for "alert" is activated then 
no alert file is written. If someone is only interested in "log" messages 
like with the database output plugin then a "-A none" should do the work
since one is not interested in the alert functions. (Most of the time both 
are called, AlertFuncs and LogFuncs.)

To summarize:

 + if an output plugin is activated it is used.
 
 + if no output plugin is specified the default is used (-> files
   in /var/log/snort)

 + there are two different facilities: "log" and "alert". These are
   most of the time the same, some preprocessors use only "alert" and
   "Tagged packets" via "tag" keyword are only forwarded to "log".

Sorry, but it took some time to realize that...

Best regards

Dirk 





More information about the Snort-users mailing list