New answers tagged snort
Changed they type from "threshold" to "limit" and it seemed to help.
This concept will do the trick for you... alert tcp any any -> any 21 (msg:"FTP traffic"; pcre:"/USER|PASS/i"; sid:666; rev:1;) This is a case-insensitive (/i) Perl Compatible Regular Expression (pcre) match for USER or (|) PASS. If you want add additional commands then simply tack them on to the end of the regex like... /USER|PASS|PASV|.../ To my ...
Snort certainly supports multiple, simultaneous log targets. I think in your desired use case the possibility may hinge on your rulesets and how you want them to log. I have never done it this way and don't have a need/desire to. Have a look at http://manual.snort.org/node21.html. This link details the Snort output options.
Top 50 recent answers are included