techapp111:/var/log # grep output /usr/local/etc/nsm/snort.conf
#  4) Configure output plugins
#                         "binary" to get them in a unified binary output
# Step #4: Configure output plugins
# Uncomment and configure the output plugins you decide to use.  General
# configuration for output plugins is of the form:
# output <name_of_plugin>: <configuration_options>
  output alert_syslog: LOG_AUTH LOG_ALERT
# output alert_syslog: LOG_AUTH LOG_ALERT
# output alert_syslog: host=hostname, LOG_AUTH LOG_ALERT
# output alert_syslog: host=hostname:port, LOG_AUTH LOG_ALERT
# The only argument is the output file name.
# output log_tcpdump: tcpdump.log
# output database: log, mysql, user=root password=test dbname=db host=localhost
# output database: alert, postgresql, user=snort dbname=snort
# output database: log, odbc, user=snort dbname=snort
# output database: log, mssql, dbname=snort user=snort password=test
# output database: log, oracle, dbname=snort user=snort password=test
# The unified output plugin provides two new formats for logging and generating
# output alert_unified: filename snort.alert, limit 128
output log_unified: filename snort.log, limit 128
# output alert_prelude
# output alert_prelude: profile=snort-profile-name
# You can optionally define new rule types and associate one or more output
#   output log_tcpdump: suspicious.log
#   output alert_syslog: LOG_AUTH LOG_ALERT
#   output database: log, mysql, user=snort dbname=snort host=localhost