Snort mailing list archives
Snort fails to dump alerts to Solaris 8 Syslog
From: "Richard Pitkanen" <rpitkanen () open com>
Date: Mon, 6 Oct 2003 17:04:10 -0400
Greetings, I've recently installed Snort on my Solaris 8 box, edited the snort.conf to allow syslog logging, yet running this command gives me nothing in syslog; "snort -s -A Fast -c /usr/local/snort-2.0.1/etc/snort.conf" root @ wolf : ~ 16:33:32 --> snort -s -A fast -c /usr/local/snort-2.0.1/etc/snort.conf Running in IDS mode Log directory = /var/log/snort Initializing Network Interface eri0 --== Initializing Snort ==-- Initializing Output Plugins! Decoding Ethernet on interface eri0 Initializing Preprocessors! Initializing Plug-ins! Parsing Rules file /usr/local/snort-2.0.1/etc/snort.conf +++++++++++++++++++++++++++++++++++++++++++++++++++ Initializing rule chains... No arguments to frag2 directive, setting defaults to: Fragment timeout: 60 seconds Fragment memory cap: 4194304 bytes Fragment min_ttl: 0 Fragment ttl_limit: 5 Fragment Problems: 0 Self preservation threshold: 500 Self preservation period: 90 Suspend threshold: 1000 Suspend period: 30 Stream4 config: Stateful inspection: ACTIVE Session statistics: INACTIVE Session timeout: 30 seconds Session memory cap: 8388608 bytes State alerts: INACTIVE Evasion alerts: INACTIVE Scan alerts: ACTIVE Log Flushed Streams: INACTIVE MinTTL: 1 TTL Limit: 5 Async Link: 0 State Protection: 0 Self preservation threshold: 50 Self preservation period: 90 Suspend threshold: 200 Suspend period: 30 Stream4_reassemble config: Server reassembly: INACTIVE Client reassembly: ACTIVE Reassembler alerts: ACTIVE Ports: 21 23 25 53 80 110 111 143 513 1433 Emergency Ports: 21 23 25 53 80 110 111 143 513 1433 http_decode arguments: Unicode decoding IIS alternate Unicode decoding IIS double encoding vuln Flip backslash to slash Include additional whitespace separators Ports to decode http on: 80 rpc_decode arguments: Ports to decode RPC on: 111 32771 alert_fragments: INACTIVE alert_large_fragments: ACTIVE alert_incomplete: ACTIVE alert_multiple_requests: ACTIVE telnet_decode arguments: Ports to decode telnet on: 21 23 25 119 1454 Snort rules read... 1454 Option Chains linked into 146 Chain Headers 0 Dynamic rules +++++++++++++++++++++++++++++++++++++++++++++++++++ Rule application order: ->activation->dynamic->alert->pass->log --== Initialization Complete ==-- Here's the edit in my snort.conf; #################################################################### # Step #3: Configure output plugins # # Uncomment and configure the output plugins you decide to use. # General configuration for output plugins is of the form: # # output <name_of_plugin>: <configuration_options> # # alert_syslog: log alerts to syslog # ---------------------------------- # Use one or more syslog facilities as arguments. Win32 can also # optionally specify a particular hostname/port. Under Win32, the # default hostname is '127.0.0.1', and the default port is 514. # # [Unix flavours should use this format...] output alert_syslog: LOG_AUTH LOG_ALERT # # [Win32 can use any of these formats...] # output alert_syslog: LOG_AUTH LOG_ALERT # output alert_syslog: host=hostname, LOG_AUTH LOG_ALERT # output alert_syslog: host=hostname:port, LOG_AUTH LOG_ALERT What else needs to be configured? Syslog is processing other events just fine. Does syslog.conf need some modifications to work with snort? Any help, ideas, or "go read this FAQ" greatly appreciated, thanks. Richard Pitkanen Sr. Customer Support Engineer Open Service http://www.open.com ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort fails to dump alerts to Solaris 8 Syslog Richard Pitkanen (Oct 06)
- Re: Snort fails to dump alerts to Solaris 8 Syslog Erek Adams (Oct 07)