From owner-freebsd-ports@FreeBSD.ORG  Mon Jun  4 14:01:02 2012
Return-Path: <owner-freebsd-ports@FreeBSD.ORG>
Delivered-To: freebsd-ports@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id B48501065673
	for <freebsd-ports@freebsd.org>; Mon,  4 Jun 2012 14:01:02 +0000 (UTC)
	(envelope-from ml@netfence.it)
Received: from cp-out8.libero.it (cp-out8.libero.it [212.52.84.108])
	by mx1.freebsd.org (Postfix) with ESMTP id 37E1B8FC17
	for <freebsd-ports@freebsd.org>; Mon,  4 Jun 2012 14:01:02 +0000 (UTC)
X-CTCH-Spam: Unknown
X-CTCH-RefID: str=0001.0A0B0203.4FCCBF97.0008,ss=1,re=0.000,fgs=0
X-libjamoibt: 1555
Received: from soth.ventu (151.41.158.135) by cp-out8.libero.it (8.5.133)
	id 4FB2CA0D03399DBD for freebsd-ports@freebsd.org;
	Mon, 4 Jun 2012 16:00:54 +0200
Received: from alamar.ventu (alamar.ventu [10.1.2.18])
	by soth.ventu (8.14.4/8.14.4) with ESMTP id q54E0mvh024654
	for <freebsd-ports@freebsd.org>; Mon, 4 Jun 2012 16:00:48 +0200 (CEST)
	(envelope-from ml@netfence.it)
Message-ID: <4FCCBF90.3000908@netfence.it>
Date: Mon, 04 Jun 2012 16:00:48 +0200
From: Andrea Venturoli <ml@netfence.it>
User-Agent: Mozilla/5.0 (X11; FreeBSD i386;
	rv:12.0) Gecko/20120509 Thunderbird/12.0.1
MIME-Version: 1.0
To: freebsd-ports@freebsd.org
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Scanned-By: MIMEDefang 2.73 on 10.1.2.13
Subject: Snort loggin
X-BeenThere: freebsd-ports@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Porting software to FreeBSD <freebsd-ports.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ports>,
	<mailto:freebsd-ports-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ports>
List-Post: <mailto:freebsd-ports@freebsd.org>
List-Help: <mailto:freebsd-ports-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ports>,
	<mailto:freebsd-ports-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 04 Jun 2012 14:01:02 -0000

Hello.

I've got a (little) problem with snort..

_ In /usr/local/etc/snort/snort.conf I have:
 > output alert_syslog: LOG_SECURITY LOG_ALERT

_ in /etc/syslog.conf:
 > security.*                                      /var/log/security
 > auth.info                                       /var/log/auth.log


Yet all snort message go to /var/log/auth.log, not /var/log/security.

Am I doing something wrong?
Should I put something else in snort.conf?

  bye & Thanks
	av.