Snort Logs

[Frank_Rizzo]

Installed Snort via Yast on Suse 9.1 and configured via webmin. Working fine but I don't understand the logging options.

1. Snort alerts are being logged in auth.log and warn logfields. How do I stop that and make in log into a snort.log logfile in the var/log/snort dir?

2. In the var/log/snort dir there are hundreds of #*$!.xxx.xxx.xxx dirs with tcp dumps in them. Is there any need for this? How do I turn it off? Can it just be set to dump to one file and not hundreds of individuals?

[MattyMoose]

1)
It looks like snort is logging to syslog, you want to change the conf file to log to file. I can't remember off the top of my head how to do that.
2)
Those files are tcpdumps of the alerts. Basically you'd associate an alert (with an IP) with the dumpfile. It wouldn't make much sense to combine all the dumpfiles into one, since it would be a nightmare trying to go through them all. This way, they're all segregated into their own alerts, etc.