[sentinix-list] RE: Alerts for rules not activated

I think I just answered my own question here. I installed Sentinix with
one interface in the box. I have since added another interface and
configured snort via gui to sniff eth1. cat'ing the eth0.conf file
answered what I started to suspect. The snortcenter gui is not updating
the eth1.conf file, but rather the eth0.conf file.

So, the next question: How do I tell Snortcenter to update the eth1.conf
file rather than eth0.conf?

Thanks in advance...

-John

-----Original Message-----
From: John Somm 
Sent: Thursday, April 22, 2004 4:22 PM
To: 'The SENTINIX Mailing List'
Subject: Alerts for rules not activated


Greetings,

I am experiencing some odd behavior of Snort rules in Sentinix. Manually
editing the config's in /usr/local/snort/sensor/rules works fine. 

However, when editing the rule set via the web gui, if I deactivate a
rule, and then view the alerts in the acid/alert console, I am still
getting alerts for those rules I have deactivated. 

Has anyone else seen this behavior?

Is this a bug in Sentinix or am I (more likely) doing something wrong?

Thanks in advance,

-John