[Snort-users] Multiple output plugins

I am trying to migrate to unified output with barnyard logging to a remote
database, but while I am finalizing all the configurations I want to run
two output processors side by side. Currently I have "output log_tcpdump:
tcpdump.log" in snort.conf and "-A fast -l /log/dir" on the command line
amongst other switches. This creates an alert file and a tcpdump file in
the log dir. So far so good.

I added
output alert_unified: filename unified.alert, limit 128
output log_unified: filename unified.log, limit 128
to snort.conf, hoping this would continue writing to alert and to
tcpdump.log and create two more files for unified output. However, what
happens is that upon restart only unified.log gets created. /log/dir/alert
keeps getting written to, but no unified.alert gets created. I suspect it
has to do with the -A switch and the fact that it overrides the output
alert_unified command.

Does anyone know how to continue logging alerts in fast format while at
the same time logging them unified format?
-------------------------------------------
Gary Portnoy






-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
This message is for the named person's use only. This communication is for
informational purposes only and has been obtained from sources believed to
be reliable, but it is not necessarily complete and its accuracy cannot be
guaranteed. It is not intended as an offer or solicitation for the purchase
or sale of any financial instrument or as an official confirmation of any
transaction. Moreover, this material should not be construed to contain any
recommendation regarding, or opinion concerning, any security. It may
contain confidential, proprietary or legally privileged information. No
confidentiality or privilege is waived or lost by any mistransmission. If
you receive this message in error, please immediately delete it and all
copies of it from your system, destroy any hard copies of it and notify the
sender. You must not, directly or indirectly, use, disclose, distribute,
print, or copy any part of this message if you are not the intended
recipient. Any views expressed in this message are those of the individual
sender, except where the message states otherwise and the sender is
authorized to state them to be the views of any such entity.

ITG Inc. reserves the right to monitor and archive all electronic
communications through its network.

ITG Inc. Member NASD, SIPC
-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-



-------------------------------------------------------
This SF.Net email is sponsored by Sleepycat Software
Learn developer strategies Cisco, Motorola, Ericsson & Lucent use to
deliver higher performing products faster, at low TCO.
http://www.sleepycat.com/telcomwpreg...rom=osdnemail3
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users