rendered paste bodyJul 18 17:44:12 b0x prelude-manager: - Regenerated 1024 bits Diffie-Hellman key for TLS.
Jul 18 20:00:13 b0x snort[3115]: Ascii: YES alert: NO
Jul 18 20:00:13 b0x snort[3115]: Double Decoding: YES alert: YES
Jul 18 20:00:13 b0x snort[3115]: %U Encoding: YES alert: YES
Jul 18 20:00:13 b0x snort[3115]: Bare Byte: YES alert: YES
Jul 18 20:00:13 b0x snort[3115]: Base36: OFF
Jul 18 20:00:13 b0x snort[3115]: UTF 8: OFF
Jul 18 20:00:13 b0x snort[3115]: IIS Unicode: YES alert: YES
Jul 18 20:00:13 b0x snort[3115]: Multiple Slash: YES alert: NO
Jul 18 20:00:13 b0x snort[3115]: IIS Backslash: YES alert: NO
Jul 18 20:00:13 b0x snort[3115]: Directory Traversal: YES alert: NO
Jul 18 20:00:13 b0x snort[3115]: Web Root Traversal: YES alert: YES
Jul 18 20:00:13 b0x snort[3115]: Apache WhiteSpace: YES alert: NO
Jul 18 20:00:13 b0x snort[3115]: IIS Delimiter: YES alert: NO
Jul 18 20:00:13 b0x snort[3115]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
Jul 18 20:00:13 b0x snort[3115]: Non-RFC Compliant Characters: NONE
Jul 18 20:00:13 b0x snort[3115]: rpc_decode arguments:
Jul 18 20:00:13 b0x snort[3115]: Ports to decode RPC on: 111 32771
Jul 18 20:00:13 b0x snort[3115]: alert_fragments: INACTIVE
Jul 18 20:00:13 b0x snort[3115]: alert_large_fragments: ACTIVE
Jul 18 20:00:13 b0x snort[3115]: alert_incomplete: ACTIVE
Jul 18 20:00:13 b0x snort[3115]: alert_multiple_requests: ACTIVE
Jul 18 20:00:13 b0x snort[3115]: telnet_decode arguments:
Jul 18 20:00:13 b0x snort[3115]: Ports to decode telnet on: 21 23 25 119
Jul 18 20:00:13 b0x snort[3115]: Portscan Detection Config:
Jul 18 20:00:13 b0x snort[3115]: Detect Protocols: TCP UDP ICMP IP
Jul 18 20:00:13 b0x snort[3115]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan
Jul 18 20:00:13 b0x snort[3115]: Sensitivity Level: Low
Jul 18 20:00:13 b0x snort[3115]: Memcap (in bytes): 10000000
Jul 18 20:00:13 b0x snort[3115]: Number of Nodes: 36900
Jul 18 20:00:13 b0x snort[3115]:
Jul 18 20:00:13 b0x snort[3115]: X-Link2State Config:
Jul 18 20:00:13 b0x snort[3115]: Ports: 25 691
Jul 18 20:00:16 b0x snort[3115]: Warning: flowbits key 'realplayer.playlist' is checked but not ever set.
Jul 18 20:00:16 b0x snort[3115]: Warning: flowbits key 'smb.tree.create.llsrpc' is set but not ever checked.
Jul 18 20:00:16 b0x snort[3115]: Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set.
Jul 18 20:00:16 b0x snort[3115]: Warning: flowbits key 'dce.bind.veritas' is set but not ever checked.
Jul 18 20:00:16 b0x snort[3115]:
Jul 18 20:00:16 b0x snort[3115]: +-----------------------[thresholding-config]----------------------------------
Jul 18 20:00:16 b0x snort[3115]: | memory-cap : 1048576 bytes
Jul 18 20:00:16 b0x snort[3115]: +-----------------------[thresholding-global]----------------------------------
Jul 18 20:00:16 b0x snort[3115]: | none
Jul 18 20:00:16 b0x snort[3115]: +-----------------------[thresholding-local]-----------------------------------
Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=3543 type=Threshold tracking=src count=5 seconds=2
Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=2923 type=Threshold tracking=dst count=10 seconds=60
Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=3273 type=Threshold tracking=src count=5 seconds=2
Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=3542 type=Threshold tracking=src count=5 seconds=2
Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=2494 type=Both tracking=dst count=20 seconds=60
Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=2495 type=Both tracking=dst count=20 seconds=60
Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=2275 type=Threshold tracking=dst count=5 seconds=60
Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=3152 type=Threshold tracking=src count=5 seconds=2
Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=2496 type=Both tracking=dst count=20 seconds=60
Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=2924 type=Threshold tracking=dst count=10 seconds=60
Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=2523 type=Both tracking=dst count=10 seconds=10
Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=3527 type=Limit tracking=dst count=5 seconds=60
Jul 18 20:00:16 b0x snort[3115]: +-----------------------[suppression]------------------------------------------
Jul 18 20:00:16 b0x snort[3115]: | none
Jul 18 20:00:16 b0x snort[3115]: -------------------------------------------------------------------------------
Jul 18 20:00:16 b0x snort[3115]: Rule application order: ->activation->dynamic->drop->alert->pass->log
Jul 18 20:00:16 b0x snort[3115]: Log directory = /var/log/snort
Jul 18 20:00:16 b0x snort[3115]: FATAL ERROR: prelude-failover: Unable to initialize prelude client: Permission denied.
Jul 18 20:00:16 b0x device eth0 left promiscuous mode
Jul 18 20:00:16 b0x audit(1153245616.388:61): dev=eth0 prom=0 old_prom=256 auid=4294967295