snort problem

manya · 03-08-2006, 07:52 AM

I have setup snort IDS on FC3 using mysql as a backend and front end is ACID, i have edited snort.conf to log snort alerts in database.
Even my snort is getting started properly without any errors but nothing is disaplyed on ACID console. when i terminate snort it shows some entries have been logged but nothing is seen on ACID console
My sensor, acid console and mysql are on single box
Can any one help me on this

conn-fused · 03-08-2006, 12:23 PM

I've only done a little work with snort, and I've not used the ACID frontend, but if I were you, I'd start by seeing if you're getting any logging out of snort. IIRC, it normally logs to /var/log/snort. If you're getting logging there, ACID is probably just looking in the wrong place. If not, you may have to look at your configuration again.

manya · 03-09-2006, 05:08 AM

Hi i am able to resolve this problem, i am using snort 2.4.1 which bydefault logs to PCAP mode , ihave changed to ascii mode when starting snort by giving -K ascii mode