FLoP - 1.6.0: Fast Logging Project for Snort
PrevChapter 6. The programs alert and dropNext

6.3. The command line options of alert and drop

Both programs use the same command line options, there is no difference between these options.

   drop | alert [-bDFhlpTvV] [-A delay] [-c config ] [-d domain] 
                [-f from] [-L level] [-m mode] [-M max] [-p port]
                [-P PIDfile] [-r rcpt] [-s socket] [-S server] [-w dir]

The alert and drop options in detail

-A delay

Try every delay seconds to send an email if there are any alerts in the buffer.

-b

Start in daemon mode, switch to a background process. This automatically activates the option -l.

-c config

This defines the name of the configuration file to use.

-d domain

Use domain as HELO string on a connection to the MailServer, see option -S.

-f from

Sets the sender address of the emails to from.

-F

Try to resolve the sensor names via DNS.

-h

Print a help text and exit.

-l

Print via syslog instead of stdout.

-L level

If a number of level alerts are buffered then send an email. A value of zero disables this feature.

-m mode

Sets the umask to mode for the daemon mode. This affects the mode for the created unix socket and PID file. The mode can be either given in ascii, octal (with leading 0) or hex (with leading 0x) format.

-M maxcount

Specifies the maximum number of tries to send an email. If still no email could be send the program alert exits and the program drop prints all alerts to stdout or syslog, see option -l.

-p port

Try to reach the mail server on this port. The default is port 25, see also option -S.

-P PIDFile

Specifies which file should be used to store the PID. This file must be writeable by the user running alert/drop!

-r recipient

Sets the address of one recipient for the emails. This option can be used several times to build a list of recipients.

-s socketname

Specifies which unix domain socket of type datagram should be opened to listen for alerts.

-S server

Specifies the mail server which should be used to send the emails. This server should allow relaying for the server running alert or drop.

-v

Print version information and exit.

-V

Activates the verbose mode, some useful informations are printed if an email is sent. This is useful for debugging if there are any problems with the mail server.

-w dir

Sets the working directory in daemon mode to dir. The default is to use the current working directory. It is useful to choose / to avoid blocking of mounted filesystems.

PrevHomeNext
The details of dropUpThe configuration file for alert and drop