Re: [sentinix-list] Snort config

Thanks for the info!
I have another question though...
I changed the cmd file to have the command
-c /usr/local/snort/sensor/rules/snort.eth0.conf -vdel /var/log/snort

Basically I need snort to throw all the alerts in /var/log/snort/alerts or something so I can have Swatch email me on events.  But Snort lists each alert under an IP directory :(  What should the command be to have it use a single file?

Thanks again

Message: 2
Date: Thu, 2 Sep 2004 18:59:38 +0530
From: Gaurav Mahendru <[email protected]>
Subject: Re: [sentinix-list] Snort config
To: The SENTINIX Mailing List <[email protected]>
Message-ID: <c00a4ebd0409020629a757b10-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
Content-Type: text/plain; charset=US-ASCII

you will find the config file here...

/usr/local/snort/sensor/rules

Regards,
Gaurav.

On Thu, 02 Sep 2004 13:17:15 -0000, Whitehat <[email protected]> wrote:
> Hi
> I am new to using Sentinix and find it a great distro to work with.
> The only problems I have right now are that I cannot seem to find where Snortcenter gets its snort configs from.  I am trying to get snort to log to a single alert file instead of numerous IP-named directories, but it does not appear to be working.  I looked at the snort.conf in /etc/snort, but it seems that everything is default there!  Where does snortcenter keep its output configs?
> 
> Thanks!
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix
> 


-- 
-- Women are like elephants. I like to look at 'em, but I wouldn't
want to own one --
--

------------------------------

_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix


End of SENTINIX Digest, Vol 15, Issue 2
***************************************