On Sun, Feb 03, 2002 at 09:04:31PM +1100, Andrew Lau wrote: > locally and remotely. So is there a bug in snort's syslog notification > capabilities? It works for me if I use: output alert_syslog: LOG_AUTH I find the Messages in /var/log/auth.log I had to remove the LOG_ALERT. Greetings Bernd