Solved

Snort alerts... how do I view?

Posted on 2014-02-14
3
1,899 Views
Last Modified: 2014-02-24
Hi I have a snort version up and running, however how do I review the alert file that is generated?
0
Comment
Question by:NYGiantsFan
  • 2
3 Comments
 
LVL 14

Expert Comment

by:comfortjeanius
ID: 39859803
According to this link, ""How to view snort log files"

From the terminal like snort -r xx.log.xxx$ or if you have barnyard2 install then you can use that...

Plus with barnyard2 you can log the output to a comma-separated file; "Snort Cookbook/Logging, Alerts, and Output Plug-ins" scroll down to "Logging to CSV file"
0
 

Author Comment

by:NYGiantsFan
ID: 39870720
This is the problem, I am not running snort, however am getting that format (running Sucatia)

As for Barnyard, it bombed during the installation onto my Linux flavor.

Doesn't some type of application or log view exist for this?  Thanks.
0
 
LVL 14

Accepted Solution

by:
comfortjeanius earned 500 total points
ID: 39870896
You can use Wireshark, tcpdump, SnortALog


Or you can use the -r switch
snort -dve -r ./snortlogs/snort.log.8732687341

Open in new window

0

Featured Post

Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

Join & Write a Comment

Article by: btan
Provide an easy one stop to quickly get the relevant information on common asked question on Ransomware in Expert Exchange.
Big data transfers via information superhighways require special attention and protection. Learn more about the IT-regulations of the country where your server is located. Analyze cloud providers and their encryption systems for safe data transit. S…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now