Which option describes where Snort alerts are sent when the WAN interface starts or stops?

Which option describes where Snort alerts are sent when the WAN interface starts or stops?

• A. Email alerts
• B. Console
• C. System log
• D. Local log file

Answer: (C)

Snort alerts for interface-state events are sent to the system log. The WAN interface starting or stopping is an OS-level change, and the system logger (syslog) is the central place where such events are recorded. By routing alerts through the system log, you can see these messages alongside other kernel and service messages in files like /var/log/syslog or /var/log/messages, depending on your distro. If you had configured alerts to go elsewhere, you’d see them there, but the standard, easiest-to-find destination for this kind of event is the system log.

Snort alerts for interface-state events are sent to the system log. The WAN interface starting or stopping is an OS-level change, and the system logger (syslog) is the central place where such events are recorded. By routing alerts through the system log, you can see these messages alongside other kernel and service messages in files like /var/log/syslog or /var/log/messages, depending on your distro.

If you had configured alerts to go elsewhere, you’d see them there, but the standard, easiest-to-find destination for this kind of event is the system log.