Location of Snort Files

57

  Other Snort configuration files like classification.config and

reference.config.

  Rule  files.

  Log files.

If you install Snort from the RPM package, the Snort binary file is usually

installed in /usr/sbin directory. If you compile Snort yourself, the location of this

file can be controlled using the 

  prefix

 command line option.

The main configuration file snort.conf is installed in /etc/snort direc 

tory when you used Snort RPM. However, you can save this file in any directory

because you have to specify path to this file on the command line when starting Snort.

In the examples used in this book, the file is stored under /opt/snort/etc direc 

tory.

Other configuration files like classification.config and refer 

ence.config are usually stored in the same location as the snort.conf file. The

path to the location of these files is found in the snort.conf file.  By changing that

path, you can control the location of these files.

Rules files are referenced in the snort.conf file. If you install Snort from the

RPM package, rules files are also installed in /etc/snort directory. In the examples

in this book, when you compile Snort yourself, you have installed these rule files under

/opt/snort/rules directory. By modifying the snort.conf file, you can select

a different location for the rule files.

The location of Snort log files can be set with the help of snort.conf file or

using command line options. Typically the log files are stored in /var/log/snort

directory. If the log directory does not exist, you have to create it manually. When Snort

is logging data from different hosts, it can create a directory for each host under /var/

log/snort for the log files.

For example, to modify the default location of log files to /snortlog, use the

following line in snort.conf file:

config logdir: /snortlog

You can also change the location of log files using   l command line option when

starting Snort. Chapter 3 contains a more detailed discussion of the snort.conf con 

figuration file.