[Snort-users] Not getting alerts in "alert" file.

waldo kitty wkitty42 at ...14940...
Tue Apr 30 19:54:34 EDT 2013

On 4/30/2013 14:14, Shields, Joseph (NIH/NIEHS) [C] wrote:
> Hi. I am not sure if my running two snort processes (each monitoring a different
> network interface) is causing the alerts to NOT show up in the alert file?

each snort instance needs its own set of config and logging files... are you 
trying to share the same logging files?

i would create /var/log/snort1 for the first instance and /var/log/snort2 for 
the second instance... i this way, each has its own alert and 
snort.log.xxxxxxxxxxxxxx files... i would also probably take the easy way out 
and use /etc/snort1.conf and /etc/snort2.conf but i'm sure that it is possible 
to use one config that has the main stuff that is all the same and then include 
different files that have the specifics for each instance... i would likely 
differentiate between them by setting and using environment variables...

eg: in the first instance's startup script
        EXPORT whichsnort=snort1

     in the second instance's startup script
        EXPORT whichsnort=snort2

     and in the script it would have %whichsnort so the config would use 
something like

   include /path/%whichsnort-vars.conf

i'm not where i can pull any actual working examples depicting this so i can 
only hope that i'm stating this in such a way as to light the lightbulb for 
you... the overall easiest way is to use completely separate confs, though... 
just make sure you edit the proper one and include any changes in both if you 
have to...

NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.

More information about the Snort-users mailing list