config set_uid: snort
config set_gid: snort
config alert_with_interface_name
config order: pass alert log activation
config nolog

output alert_syslog: log_local4 log_info

preprocessor flow: stats_interval 0 hash 2
preprocessor frag3_global: max_frags 65536
preprocessor frag3_engine: detect_anomalies
preprocessor stream4: detect_scans
preprocessor stream4_reassemble
preprocessor sfportscan: proto { all } scan_type { all } sense_level { low }