<html>
  <head>
    <meta content="text/html; charset=windows-1252"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    You need to set --plugin-path so data_log can be loaded.  Also look
    at <a class="moz-txt-link-freetext" href="http://blog.snort.org/2015/04/snort-inspection-events.html">http://blog.snort.org/2015/04/snort-inspection-events.html</a> for
    how to use data_log.<br>
    <br>
    <div class="moz-cite-prefix">On 6/14/16 1:12 PM, Akhil Koul wrote:<br>
    </div>
    <blockquote
cite="mid:CAK9eeqXuAQC661L_1B-96Cqq=H-=s7KePCuP_vyWpUk9p9_LJQ@...11828..."
      type="cite">
      <meta http-equiv="Content-Type" content="text/html;
        charset=windows-1252">
      <div dir="ltr">Hello
        <div><br>
        </div>
        <div>Can someone tell me how to run data_log inspector.  I have
          already added data_log = {key = http_raw_uri} into the
          snort.lua file. When i run snort, all inspectors except
          data_log show up.</div>
        <div><br>
        </div>
        <div>Also, i wanted to capture HTTP URIs from data logger. How
          do I do that?</div>
        <div>I see that hi_main.cc publishes http_uri. I need to
          capture/publish all fields buffers[] array in http_inspect.cc
          file.</div>
        <div><br>
        </div>
        <div>Thanks</div>
        <div>AKhil</div>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are 
consuming the most bandwidth. Provides multi-vendor support for NetFlow, 
J-Flow, sFlow and other flows. Make informed decisions using capacity 
planning reports. <a class="moz-txt-link-freetext" href="https://ad.doubleclick.net/ddm/clk/305295220;132659582;e">https://ad.doubleclick.net/ddm/clk/305295220;132659582;e</a></pre>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">_______________________________________________
Snort-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Snort-users@lists.sourceforge.net">Snort-users@lists.sourceforge.net</a>
Go to this URL to change user options or unsubscribe:
<a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/snort-users">https://lists.sourceforge.net/lists/listinfo/snort-users</a>
Snort-users list archive:
<a class="moz-txt-link-freetext" href="http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users">http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users</a>

Please visit <a class="moz-txt-link-freetext" href="http://blog.snort.org">http://blog.snort.org</a> to stay current on all the latest Snort news!</pre>
    </blockquote>
    <br>
  </body>
</html>