<snip> ----------------------------------------------------- If snort is logging to syslog, then you need to configure your syslogd to forward the traffic to the other host. Once Snort dumps the traffic to /dev/log, it is not the responsibility of Snort to send it elsewhere.

man 5 syslog.conf man 8 syslogd ----------------------------------------------------- </snip>

THe point is /var/log messages gets alogs with all priorities and facilities

the default priority and facility for snort is log_auth and log_alert which causes syslog to log it in /var/log/secure

i want snort to log alerts with priority local6 and facility alert

then my syslog would redirect all syslogs with priority local6 (based on a rule i write in syslog.conf) to a listener ( netforensics agent)

so while i get logs in /varlog/messages i am not able o send it to the file or location i want and with the priority and facility i want

===== ninad purohit ninadonline(at)yahoo(dot)co(dot)in have a nice day :-)

__________________________________ Do you Yahoo!? Yahoo! Mail - Helps protect you from nasty viruses. http://promotions.yahoo.com/new_mail