what does Snort use to organize the alert data?

When you instruct Snort to place ASCII-formatted log data in a specific directory, what does
Snort use to organize the alert data?

A.
packet

B.
IP address

C.
port number

D.
interface