Not Logging

Problem

You want to create an alert but not to log something.

Solution

Use the log_null output plug-in. This allows you to create an alert that doesn't create log entries.

output log_null

 

Discussion

There are occasions when you might want to draw attention to an event, but not record it for future reference. This allows you to create a powerful monitoring system, but not to have to worry about using huge amounts of disk space logging everything.

See Also

Snort Users Manual

Prioritizing Alerts