Fwd: Re: [Snort-users] abnormal spade behavior!

 Note: forwarded message attached.

attached mail follows:

In the Name of the Dearest
Dear James
AsIdon have access to my IDS now and you know spade versions are somehowcomplicated I don't know what versionI use, Just I know it's the version comming with snort-stable (1.9.0) and I'vedownloaded it about 2weeks ago. I've read the Documentation. I myself enabled the survey also enabled database reporting and I saw some alerts there, survey files are also created.But spade.rcv is never created. spade.log was created at some start ups but was empty andsome times there wereamessage telling that snort is okbut spade has shut down! by the way I'm using snort 1.9.0 on redhat 8.0, AMD Athlon 900 + 128MB of RAM. and I run a fresh proccess of snort for spade with no rules, just spade preproccessors and database output. Regards
Mahdi Kefayati
 James Hoagland <jim@SiliconDefense.com> wrote:At 12:31 AM -0800 2/24/03, Mahdi Kefayati wrote:
>In the Name of the Dearest

Mahdi,

What version of Spade are you using?

Note that the spade.rcv file will only be created periodically (by default after 50000 updates), on certain signals, and on snort exit. Spade.log is only created on snort exit.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related snort.org Links snort-announce snort-cvsinfo snort-devel snort-sigs snort-users Request more information about Pantek

Also, if you are using the standard configuration, you should not be seeing any survey files since survey mode is disabled in that document.

Kind regards,

Jim

-- 
|* Jim Hoagland, Associate Researcher, Silicon Defense *|
|* --- Silicon Defense: The Cyberwar Defense Company --- *|
|* 
jim(at)SiliconDefense.com, 
http://www.silicondefense.com/ *|
|* Voice: (530) 756-7317 Fax: (530) 756-7297 *|


---------------------------------
Do you Yahoo!?
Yahoo! Tax Center - forms, calculators, tips, and more



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users