Hi guys,

i was wondering if anybody can point me in the right direction.

i have a new install of snort 2.1, sensor, ACID, and snortcenter running on the same box...Fedora redhat. When the sensor is running i use another box to connect to the ACID console to view alerts, etc… however nothing shows up in ACID. No alter etc...

When i start snort in /etc/snort i get no error messages, everything seems to run fine. Also the rule files are in the same directory \etc\snort

for some reason the alerts don't get logged in /var/log/snort i checked the snort.conf file where i make the database connection and all looks good yet nothing gets logged. HELP

PS when i setup a test rule in snort.conf, ACID sees it when i start snort, but the alerts in the default rules don't get logged to /var/log/snort

Does this make sense?

is there anything in /var/log/messages when u start snort?

is snort actually running ??

whats the output of #ps -ef | grep snort

did you set the path to snort rules correctly in snort.conf?

im not sure how u log snort alerts ...but i used to run snort with logging to mysql

i know snort is running becauase i have a snortd file in /etc/rc.d/init.d/ that i use to stop/start snort. my snort.con file points to /etc/snort for the default rules. i also use mysql to log the alerts

here is the output i get when i run #ps -ef | grep snort

root 1932 1 0 15:45 ? 00:00:00 /usr/bin/perl /opt/snortagent/sensor/miniserv.pl /etc/snort/miniserv.conf
root 2574 1 0 16:13 ? 00:00:00 /usr/local/bin/snort -U -o -i eth0 -d -D -c /etc/snort/snort.conf
root 2583 2006 0 16:14 pts/1 00:00:00 grep snort
[root@g6zx snort]#

and my /var/log/snort has these files

-rw------- 1 root root 0 Mar 18 16:13 alert
-rw-r--r-- 1 root root 808 Mar 18 15:53 miniserv.error
-rw------- 1 root root 833 Mar 18 15:53 miniserv.log
-rw-r--r-- 1 root root 5 Mar 18 15:45 miniserv.pid
-rw------- 1 root root 119291 Mar 18 15:41 tcpdump.log.1079561859


as you can see the alert log has "0" log and the miniserv.error has some errors, but nothing with regards to snort.

i will trace my steps again to see if i missed a step. thanks a bunch for your help, if you think of anything else let me know.......Nick B