snort sfportscan日志文件输出不具有event_id，而是event_ref且值为0

Question

我的配置如下：

preprocessor sfportscan: proto { all } \
scan_type  { all } \
sense_level { high } \
logfile { alert }

当我运行snort并使用nmap进行扫描时，日志文件输出如下：

Time: 02/23-12:54:21.183932 
event_ref: 0
[Source ip address] -> [Destination ip address] (portscan) TCP Portscan
Priority Count: 9
Connection Count: 10
IP Count: 1
Scanner IP Range: [Destination ip address]:[Destination ip address]
Port/Proto Count: 10
Port/Proto Range: 981:12174

但是snort文档是这样说的：

Time: 09/08-15:07:31.603880
event_id: 2
192.168.169.3 -> 192.168.169.5 (portscan) TCP Filtered Portscan
Priority Count: 0
Connection Count: 200
IP Count: 2
Scanner IP Range: 192.168.169.3:192.168.169.4
Port/Proto Count: 200
Port/Proto Range: 20:47557

如果目标上有开放端口，将附加一个或多个其他带标记的数据包：

Time: 09/08-15:07:31.603881
event_ref: 2
192.168.169.3 -> 192.168.169.5 (portscan) Open Port
Open Port: 38458

我没有event_id，而是event_ref，其值为0