[Snort-users] unified2 output
cshaffer at ...11827...
Wed May 5 10:13:55 EDT 2010
I'm having an issue with an upgrade I just did to the latest Snort
version ( Version 2.8.6 (Build 38)) on a CentOS 5.4 install. Snort
seems to run but snort seems to disregard my unified2 output in the
configuration. Here is my output portion of my config:
output unified2: filename snort.u2, limit 128
With that I would expect the file in /var/log/snort to be called
snort.u2. Is that correct? What I get insstead is a file named
snort.log.xxxxxxxxxx (the x's change on every start).
Here is my process list when I start Snort:
/usr/local/bin/snort -A fast -b -d -D -i eth1 -u snort -g snort -c
/etc/snort/snort.conf -l /var/log/snort
I did ensure that I do not have any other outputs in the config.
More information about the Snort-users