Joe McAlerney (joeySiliconDefense.com) wrote:
> Hello Ron,
>
> Ron 'The InSaNe One' Rosson wrote:
>
> > output database: log, mysql, user=snort dbname=snort host=localhost
> ^^^
> Change this to 'alert'. In the CVS version of Snort, the portscan
> plugin calls all output plugins registered as type 'alert' rather then
> 'log'.
>

Tried that and did a portscan from an untrusted host and still no
portscan logging to mysql. ANd now it is not logging to syslog either.

The rule sets are from araachnids vision.conf

I am baffled

-- 
------------------------------------------------------------------------------
Ron Rosson          			      ... and a UNIX user said ...
The InSaNe One                 			      rm -rf *
insaneoneinsane.net     	            and all was /dev/null and *void()
------------------------------------------------------------------------------
     The three Rs of Microsoft support: Retry, Reboot, Reinstall.
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]