[Snort-users] Not getting alerts in "alert" file.
wkitty42 at ...14940...
Tue Apr 30 19:54:34 EDT 2013
On 4/30/2013 14:14, Shields, Joseph (NIH/NIEHS) [C] wrote:
> Hi. I am not sure if my running two snort processes (each monitoring a different
> network interface) is causing the alerts to NOT show up in the alert file?
each snort instance needs its own set of config and logging files... are you
trying to share the same logging files?
i would create /var/log/snort1 for the first instance and /var/log/snort2 for
the second instance... i this way, each has its own alert and
snort.log.xxxxxxxxxxxxxx files... i would also probably take the easy way out
and use /etc/snort1.conf and /etc/snort2.conf but i'm sure that it is possible
to use one config that has the main stuff that is all the same and then include
different files that have the specifics for each instance... i would likely
differentiate between them by setting and using environment variables...
eg: in the first instance's startup script
in the second instance's startup script
and in the script it would have %whichsnort so the config would use
i'm not where i can pull any actual working examples depicting this so i can
only hope that i'm stating this in such a way as to light the lightbulb for
you... the overall easiest way is to use completely separate confs, though...
just make sure you edit the proper one and include any changes in both if you
NOTE: No off-list assistance is given without prior approval.
Please keep mailing list traffic on the list unless
private contact is specifically requested and granted.
More information about the Snort-users