[Snort-users] Multiple log files

waldo kitty wkitty42 at ...14940...
Wed Jan 7 21:20:11 EST 2015

On 1/6/2015 11:44 AM, test engineer wrote:
> Thanks for any assistance.
> I'm runnig snort and using an Emulex DAG card as the monitor interface.
> I'm running
> 8 snort processes in a balanced stream configuration.  After starting snort, I
> notice that some times it creates 2 or even 3 log files in /var/log/snort.  I'm
> wondering why it creates 2 or 3 and not just 1.
> -rw-r--r--. 1 root root 0 Jan  6 11:35 alert
> -rw-------. 1 root root 0 Jan  6 11:35 snort.log.1420562102
> -rw-------. 1 root root 0 Jan  6 11:35 snort.log.1420562103

those are pcap files... there should be one for each process... they will 
contain the packet data that triggered the alerts snort raised... each process 
should have unique names for these and similar output files they write...

  NOTE: No off-list assistance is given without prior approval.
        Please *keep mailing list traffic on the list* unless
        private contact is specifically requested and granted.

More information about the Snort-users mailing list