Posted by hans2 on Feb 29, 2016; 1:01am
URL: https://itus.accessinnov.com/Speed-issue-due-to-log-size-too-big-SOLUTION-tp189p208.html

/etc/snort/reference.config sets variables only - no harm if it referred multiple times.

root@Shield:/etc/snort# cat reference.config

# $Id$
# The following defines URLs for the references found in the rules
#
# config reference: system URL

config reference: bugtraq   http://www.securityfocus.com/bid/
config reference: cve       http://cve.mitre.org/cgi-bin/cvename.cgi?name=
config reference: arachNIDS http://www.whitehats.com/info/IDS
config reference: osvdb     http://osvdb.org/show/osvdb/

# Note, this one needs a suffix as well.... lets add that in a bit.
config reference: McAfee    http://vil.nai.com/vil/content/v_
config reference: nessus    http://cgi.nessus.org/plugins/dump.php3?id=
config reference: url       http://
config reference: msb       http://technet.microsoft.com/en-us/security/bulletin/