ERROR: Portscan log file 'log/\portscan.log' could not be opened: No such file or directory

[jmcclure]

Hello,

I am following the Installing an IIS Web Server Logging events to a mysql database and I am receiving the following error when testing my conf file:

 

ERROR: Portscan log file 'log/\portscan.log' could not be opened: No such file or directory.

Fatal Error, Quitting..

My snort configuration file is configured as such

preprocessor sfportscan: proto  { all } memcap { 10000000 } sense_level { low } logfile { \portscan.log }

 

any help would be greatly appreciated!

Thanks!

 

[Morpheus]

Attach your snort.conf

[jmcclure]

here is my snort.conf

snort.conf

[Morpheus]

Try this one...

snort.conf

[jmcclure]

I received the same error using the conf file that you provided.

ERROR: Portscan log file 'log/\portscan.log' could not be opened: No such file or directory.
Fatal Error, Quitting..

 

[Morpheus]

Make sure there is a log folder in the snort folder

This looks odd: ERROR: Portscan log file 'log/\portscan.log' could not be opened: No such file or directory.

Try this: preprocessor sfportscan: proto  { all } memcap { 10000000 } sense_level { low } logfile { portscan.log }

[jmcclure]

Hello,

I do have a log folder in the snort folder. The log folder is empty.  When I use preprocessor sfportscan: proto  { all } memcap { 10000000 } sense_level { low } logfile { portscan.log } it returns this error

Decoding Ethernet
ERROR: Portscan log file 'log/portscan.log' could not be opened: No such file or
 directory.
Fatal Error, Quitting..

 

If I disable the portscan by adding the # symbol it returns this error:

Decoding Ethernet
ERROR: C:\mar21_snortbuild\snort-2.9.8.2-335\src\output-plugins\spo_unified2.c(3
23) Could not open log/merged.log.1465563828: No such file or directory
Fatal Error, Quitting..

Thank you for your help so far!  any ideas on what I need to do?

[Morpheus]

It appears you have some sort of problem with the log folder (permission, etc...).

[jmcclure]

I figured it out.....

I think there is a step missing in the install guide "installing an IIS Web Server logging events to a MySQL Database".

when configuring the snort.conf file......

in step #2 line # 186 needs to be changed to

config logdir: d:\winids\snort\log

 

 

 

 

 

 

[Morpheus]

If Snort is setup correctly queries to the log folder are defaulted to the snort folder.