Gijo, The two packet logging options actually do separate things:
- packetlog.enabled in the sensor's properties: This logs all traffic from the monitoring interface of the sensor. This is useful if you are concerned the sensor is listening on the wrong interface and may not be seeing the traffic you are expecting it to see. This option is not related to what events get fired. By default, these packet logs will be saved to the sensor's Logs\ directory and will be named Log001.enc through Log010.enc. Options for this are configurable in the sensor's Advanced Parameters of the sensor Properties. - Log Evidence: This is what logs the network traffic which occurs after an event fires. Only events which have the Log Evidence response turned on will save packet captures. The packetlog.enabled option does not have to turned on in order for this to work. By default, these packet logs will be saved to the sensor's Logs\ directory and will be named ev001.enc through ev035.enc. Options for this are configurable in the Response policy applied to the sensor. Keep in mind these are completely separate -- they can be turned on independently of each other. If you find that your Log Evidence (or files which begin with "ev") packets are not being saved, make sure the events which you turned this response on for have actually fired after you applied the Policy that turned this response on. _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
