Snort Excluding Multiple Ports From ShellCode rules

I am wrestling with the same issue right now. The closest I have found to official docs on tuning is:

There are at least three ways of doing this:
a. Filtering at origin (disabling a snort rule, setting a tcpdump-style filter at p0f, etc...)
b. Policy
c. Agent Consolidation (undocumented)

I have started working on removing the false positives via policies--we shall see how it goes.

Josh

I've done some additional research and found that using the latest version of Barnyard - firnsy-barnyard2-v2-1.10-beta2-28, gives me the additional logging I've wanted. It now has the ability to send full packet data to syslog. Below are the new options in the barnyard2.conf file.

output log_syslog_full: sensor_name snort-sensor, local, operation_mode default

OR

output log_syslog_full: sensor_name snort-sensor, local, operation_mode complete