[Snort-users] unified2 output

Curt Shaffer cshaffer at ...11827...
Wed May 5 10:13:55 EDT 2010

I'm having an issue with an upgrade I just did to the latest Snort
version ( Version 2.8.6 (Build 38)) on a CentOS 5.4 install. Snort
seems to run but snort seems to disregard my unified2 output in the
configuration. Here is my output portion of my config:

output unified2: filename snort.u2, limit 128

With that I would expect the file in /var/log/snort to be called
snort.u2. Is that correct? What I get insstead is a file named
snort.log.xxxxxxxxxx (the x's change on every start).

Here is my process list when I start Snort:

 /usr/local/bin/snort -A fast -b -d -D -i eth1 -u snort -g snort -c
/etc/snort/snort.conf -l /var/log/snort

I did ensure that I do not have any other outputs in the config.

Any suggestions?



More information about the Snort-users mailing list