Swatch installation's issue to detect intrusion

Question

I have installed snort and I want to use the swatch tool to send me an email when it detects something going wrong. I am using OSX and I followed the installation guide: http://www.snort.org/assets/188/Building_Snort_for_Mac_OS_X.pdf

In the .swatchrc file, I added these lines:

watchfor /Priority\: 1/i
mail addresses=USERNAME\@DOMAIN,subject=[SNORT] Priority 1 Alert

I put swatch as a daemon:

sudo swatch --daemon -c /etc/swatch/.swatchrc -t /var/log/snort/alert

and finally wrote a plist file in order to launch swatch at boot time. The problem is tht I don't receive anything when I connect to my os with an ssh connection from an other device. Could someone help ?

(Here's the plist file

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://
www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>Label</key>
        <string>net.sourceforge.swatch</string>
        <key>KeepAlive</key>
        <false/>
        <key>RunAtLoad</key>
        <true/>
        <key>ProgramArguments</key>
        <array>
                <string>/usr/local/bin/swatch</string>
                <string>--daemon</string>
                <string>-c</string>
                <string>/etc/swatch/.swatchrc</string>
                <string>-t</string>
                <string>/var/log/snort/alert</string>
Page 16 of 17        </array>
        <key>ServiceDescription</key>
        <string>Swatch 3.2.3</string>
</dict>
</plist>)