I have installed and configured snort 2.1.0. I have successfully configured it to work with Postgres. I am collecting data, and can see that data in Postgres. I am getting plenty of http_inspect alerts generated, and they are succesfully showing up in the ACID reports. I have created scripts to download updated rule sets, unpack them, test them, and impliment them. Working great... However, I am not generating any alerts from any rule sets, only preprocessor alerts, such as the http_inspect as stated above. I have the default rules enabled, as it comes default in snort.conf in 2.1.0. I have read README.alert_order, and have read several posts on how to check your snort conf. I have included my snort.conf below. I have run Nessus, using all tests, on all ports, against the snort IP, and an IP on the internal net from an IP outside the network. Can anyone see why I am not getting any alerts generated? I am at a loss. I can include my snort.conf at request, but due to it's length have excluded it. Ben Jordan _______________________________________________ TCLUG Mailing List - Minneapolis/St. Paul, Minnesota Help beta test TCLUG's potential new home: http://plone.mn-linux.org Got pictures for TCLUG? Beta test http://plone.mn-linux.org/gallery tclug-list at mn-linux.org https://mailman.real-time.com/mailman/listinfo/tclug-list