Noisy logs are the bane of every administrator's existence! How do you reduce the size of your haystack to help find that all-important needle?
Use the threshold keyword:
threshold: type , track , count , seconds ;
Thresholding is a useful way of thinning down your logs. It also allows you to monitor for other unusual behavior. If you suddenly see a lot of NFS errorsas opposed to one or two every minuteyou certainly have a problem, but you won't want to be alerted for every single NFS error.
To alert the first n times that an event happens during a time interval, use limit. To alert every nth occurrence during the time interval, use threshold.
There is also the combination type of both, which alerts once after n instances of the event.
The track keyword is used to monitor traffic either by source IP address or destination IP address. It provides a method for grouping events to enable thresholding. Tracking is done either by source or destination IP address only; there is no tracking done on ports or any other criteria. The count is the number of events for the tHReshold and both types, and the number of alerts for the limit type. The seconds option sets the time during which the events should be counted, and, funnily enough, is in seconds.
So to set the threshold of an alert on every ten occurrences of a rule within a five second period from the source for the rule, use the following:
threshold: type threshold, track by_src, count 10, seconds 5;
Snort User Manual
Excluding from Logging
Installing Snort from Source on Unix
Logging to a File Quickly
How to Build Rules
Detecting Stateless Attacks and Stream Reassembly
Managing Snort Sensors
Generating Statistical Output from Snort Logs
Monitoring Network Performance