[Snort-users] unified2 output

Curt Shaffer cshaffer at ...11827...
Wed May 5 10:37:08 EDT 2010


Worked like a charm. Thanks!

On Wed, May 5, 2010 at 10:26 AM, Joel Esler <jesler at ...1935...> wrote:
> Remove your "-A fast -b" from your command line.  Remember that command line
> overrides conf file.
> J
>
> On Wed, May 5, 2010 at 10:13 AM, Curt Shaffer <cshaffer at ...11827...> wrote:
>>
>> I'm having an issue with an upgrade I just did to the latest Snort
>> version ( Version 2.8.6 (Build 38)) on a CentOS 5.4 install. Snort
>> seems to run but snort seems to disregard my unified2 output in the
>> configuration. Here is my output portion of my config:
>>
>> output unified2: filename snort.u2, limit 128
>>
>> With that I would expect the file in /var/log/snort to be called
>> snort.u2. Is that correct? What I get insstead is a file named
>> snort.log.xxxxxxxxxx (the x's change on every start).
>>
>> Here is my process list when I start Snort:
>>
>>  /usr/local/bin/snort -A fast -b -d -D -i eth1 -u snort -g snort -c
>> /etc/snort/snort.conf -l /var/log/snort
>>
>> I did ensure that I do not have any other outputs in the config.
>>
>> Any suggestions?
>>
>> Thanks
>>
>> Curt
>>
>>
>> ------------------------------------------------------------------------------
>> _______________________________________________
>> Snort-users mailing list
>> Snort-users at lists.sourceforge.net
>> Go to this URL to change user options or unsubscribe:
>> https://lists.sourceforge.net/lists/listinfo/snort-users
>> Snort-users list archive:
>> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>




More information about the Snort-users mailing list