[Snort-users] HOW DOES ONE STOP an alert file from being Produced?
Dirk_Geschke at ...1344...
Thu Mar 9 07:57:01 EST 2006
> > To turn off alerting, use "-A none" at the command line. To turn off
> > logging, you can use -N at the command line or add a "output
> > log_null" in the snort.conf file.
> yes, but "-A none" will also disable all output plugins. This is sometimes
> not desired...
I have to correct myself... If an output plugin for "alert" is activated then
no alert file is written. If someone is only interested in "log" messages
like with the database output plugin then a "-A none" should do the work
since one is not interested in the alert functions. (Most of the time both
are called, AlertFuncs and LogFuncs.)
+ if an output plugin is activated it is used.
+ if no output plugin is specified the default is used (-> files
+ there are two different facilities: "log" and "alert". These are
most of the time the same, some preprocessors use only "alert" and
"Tagged packets" via "tag" keyword are only forwarded to "log".
Sorry, but it took some time to realize that...
More information about the Snort-users