Re: alert_json logger - not working

Try this…


alert_json =
{
    fields =
    [[
        action src_addr dst_addr flowstart_time gid client_bytes client_pkts server_bytes server_pkts
    ]]
}


Albert Lewis
ENGINEER.SOFTWARE ENGINEERING
Cisco Systems Inc.
Email: [email protected]<mailto:[email protected]>



From: Snort-users <[email protected]> on behalf of "Al Lewis (allewi) via Snort-users" <[email protected]>
Reply-To: "Al Lewis (allewi)" <[email protected]>
Date: Wednesday, March 30, 2022 at 1:10 AM
To: Michael Heard <[email protected]>, "[email protected]" <[email protected]>
Subject: Re: [Snort-users] alert_json logger - not working

Hello,

Do you get alerts using one of the other logging methods (-Acsv)?

Albert Lewis
ENGINEER.SOFTWARE ENGINEERING
Cisco Systems Inc.
Email: [email protected]<mailto:[email protected]>



From: Snort-users <[email protected]> on behalf of Michael Heard via Snort-users <[email protected]>
Reply-To: Michael Heard <[email protected]>
Date: Wednesday, March 30, 2022 at 12:11 AM
To: "[email protected]" <[email protected]>
Subject: [Snort-users] alert_json logger - not working

Hello,

I have recently installed Snort3 on Centos Stream 8, using the instructions provided by Snort 3 on the CentOS 8 Stream document (Snort_3_GA_on_CentOS8_Stream.pdf). I believe I successfully completed the steps of sections 7.5 (Configuring alert_json Logger), but the installation doesn't appear to work. A file is created with the name "alert_json.txt, but it doesn't contain any contents. Is something missing in my configuration? Can someone provide some insight into what might be causing this problem?

See attachments:

  1.  snort.lua
  2.  snort_default.lua
  3.  Results of running a test against a pcap.
Here's what the snort log folder looks like:

[root@localhost snort]# cd /var/log/snort/
[root@localhost snort]# ls -la
total 4
drws-----T.  2 snort snort   50 Mar 29 21:04 .
drwxr-xr-x. 10 root  root  4096 Mar 27 03:49 ..
-rw-r--r--   1 root  root     0 Mar 29 21:04 alert_fast.txt
-rw-r--r--   1 root  root     0 Mar 29 21:04 alert_json.txt


Thanks

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette