|
Hi all,
i have difficulties to understand what informations are logged and how they
are logged...
At the beginning, i've used the output alert_unified of snort, so it create
the snort.alert file and a lot of directories (for example 192.168.1.100,
192.168.1.5, 255.255.255.255) I just add that i use three rules in order to test
the output :
alert tcp any any -> any any (msg:"tcp snort";)
alert udp any any -> any any (msg:"udp snort";)
alert icmp any any -> any any (msg:"icp snort";)
So i think that snort.alert contain alert informations and the directoris
other log information, am i wrong?
Now, i use output alert unified and log_unified, so i have one snort.alert
file and one snort.log file. I want to know if informations in the snort.log are
the same as in directories?
And what about barnyard using files? Does it log the same thing in the two
situation? Or does it log more information with the directories?
Thanks a lot for your help!
lm.
| 
