Posted by hans2 on Mar 14, 2016; 2:29pm
URL: https://itus.accessinnov.com/Hotfix-160301-FINAL-tp157p442.html

Hi Roadrunner,

sorry, planned:

20)     = IPS - LOG PROBLEM
        > /etc/snort/snort.conf
        - disabled preproc_rules for preprocessor, decoder and sensitive date
        - ref http://itus.accessinnov.com/Speed-issue-due-to-log-size-too-big-SOLUTION-td189.html

but I did not commit, see

include $RULE_PATH/local.rules
include $RULE_PATH/snort.rules
include $PREPROC_RULE_PATH/preprocessor.rules
include $PREPROC_RULE_PATH/decoder.rules
include $PREPROC_RULE_PATH/sensitive-data.rules
# include $SO_RULE_PATH/so1.rules
# include $SO_RULE_PATH/so2-misc.rules

Please use the < raw> and < /raw>  (remove first space) commands to display code, it makes the posting easier to read.

do you want me to change this in snort.conf, snort7.8 too?