Log trouble
Jacko B via Snort-users <[email protected]> Tue, 07 Jan 2025 09:08:56 -0600
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <[email protected]> |
--===============7136020567594515751==
Content-Type: multipart/alternative;
boundary="----=_Part_35083_30278551.1736262536351"
------=_Part_35083_30278551.1736262536351
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Hello everyone, I was wondering if anyone had any suggestions for some logging trouble I am having. I am using snort++ version 3.6.0.0After installing I tried to set up logs for alerts to output to. I wanted to encrypt the logs and rotate them every 90 days so I set that up and then configured lua where to output. My configuration passes and snort runs successfully but I can't seem to log anything. I added a custom rule for testing purposes that alert "any any ip" and finally today I was able to trigger an alert but still no logs. I am willing to use an alternative logging mechanism at this point but figured I would reach out for help first. I can send pics of my configuration and I appreciate any and all help.
------=_Part_35083_30278551.1736262536351
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head>=
<meta content=3D"text/html;charset=3DUTF-8" http-equiv=3D"Content-Type"></h=
ead><body ><div style=3D'font-size:10pt;font-family:Verdana,Arial,Helvetica=
,sans-serif;color:#000000;'><div ><div>Hello everyone, I was wondering if a=
nyone had any suggestions for some logging trouble I am having. I am using =
snort++ version 3.6.0.0</div><div>After installing I tried to set up logs f=
or alerts to output to. I wanted to encrypt the logs and rotate them every =
90 days so I set that up and then configured lua where to output. My config=
uration passes and snort runs successfully but I can't seem to log anything=
. I added a custom rule for testing purposes that alert "any any ip" and fi=
nally today I was able to trigger an alert but still no logs. I am willing =
to use an alternative logging mechanism at this point but figured I would r=
each out for help first. I can send pics of my configuration and I apprecia=
te any and all help.</div> <br> </div> </div><=
br></body></html>
------=_Part_35083_30278551.1736262536351--
--===============7136020567594515751==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users
To unsubscribe, send an email to:
[email protected]
Please visit http://blog.snort.org to stay current on all the latest Snort news!
Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
--===============7136020567594515751==--