[Snort-users] Unified logging doesn't work.

Steve Crow scrow at ...16818...
Mon Jun 9 17:16:36 EDT 2014

In the /etc/sysconfig/snort file there is this:

#### General Configuration

# What interface should snort listen on?  [Pick only 1 of the next 3!]
# This is -i {interface} on the command line
# This is the snort.conf config interface: {interface} directive
# The following two options are not directly supported on the command line
# or in the conf file and assume the same Snort configuration for all
# instances
# To listen on all interfaces use this:
# To listen only on given interfaces use this:
INTERFACE="eth0 eth1"


I included the full text in a reply to Joel. I am considering changing this to ALL if Barnyard2 will work with a single unified file that covers more than one interface. We're not a high bandwidth operation, so I don't think I need to configure separate processes and configuration files for each interface.


-----Original Message-----
From: James Lay [mailto:jlay at ...13475...] 
Sent: Monday, June 09, 2014 3:28 PM
To: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Unified logging doesn't work.

On 2014-06-09 14:19, Steve Crow wrote:
> I am having a similar issue. I am trying to monitor two interfaces.
> I have the snort.conf output setup like this:
> output unified2: filename merged.log, limit 128,
> But I have alert files showing up in each interface directory in plain 
> text.
> The /etc/sysconfig/snort file seems to be controlling this, but I 
> don't see an option for output using unified2 in the sysconfig/snort 
> file, or for having a merged.log for both interfaces that I can 
> monitor.
> Doing a search doesn’t reveal a merged.log either.
> Thank you,
> Steve

How are you monitoring both interfaces?

HPCC Systems Open Source Big Data Platform from LexisNexis Risk Solutions Find What Matters Most in Your Big Data with HPCC Systems Open Source. Fast. Scalable. Simple. Ideal for Dirty Data.
Leverages Graph Analysis for Fast Processing & Easy Data Exploration http://p.sf.net/sfu/hpccsystems _______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

Please visit http://blog.snort.org to stay current on all the latest Snort news!

More information about the Snort-users mailing list