Snort mailing list archives
RE: Syslogging question
From: Rich Adamson <radamson () routers com>
Date: Tue, 24 Aug 2004 06:14:10 -0600
Steve, Not sure what all you've tried, but consider... 1. use the snort.conf to send the alerts to the linux syslog facility, 2. configure the linux syslog facility to "handle" the incoming snort alerts 3. restart linux syslogd (required to reread config changes) 4. verify the linux syslogd is actually writing to a /var/log... file 5. when that is working, then add a linux syslog.conf statement (leave snort.conf alone) to forward these incoming messages to a distant machine (kiwi syslog). The syntax is something like "kern.crit @kiwi.machine.com" and can be found in 'man syslog.conf'. 6. when all of that is working, then try messing around with forwarding syslog messages directly from snort to kiwi, bypassing linux syslogd. I use snort on win32 with syslog a lot (for low volume sensors), but not on linux systems. I faintly recall (from a long time ago) that snort on linux writes the syslog messages via the linux OS calls (not the ip stack), and likely requires you config to first write the alerts to the linux syslog. All unix systems that I'm familiar with have a syslog config option to forward syslog messages to a distant machine "after" the unix syslog function receives the message. Remember any changes to /etc/syslog.conf requires a restart of the linux syslogd. Rich ------------------------
Tried it just then, but still no messages in syslog... Steve-----Original Message----- From: Matt [mailto:matt () bfinity kicks-ass net] Sent: Tuesday, 24 August 2004 1:18 PM To: Steve Subject: Re: [Snort-users] Syslogging question Sorry I Didnt read, :) just for curiosity sake did you try it? Steve wrote:Matt, As I read it, the host= format only applies to the win32 version, not the Unix version... Steve-----Original Message----- From: Matt [mailto:matt () bfinity kicks-ass net] Sent: Monday, 23 August 2004 3:14 PM To: Steve Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] Syslogging question #################################################################### # Step #3: Configure output plugins # # Uncomment and configure the output plugins you decide to use. General # configuration for output plugins is of the form: # # output <name_of_plugin>: <configuration_options> # # alert_syslog: log alerts to syslog # ---------------------------------- # Use one or more syslog facilities as arguments. Win32 can also optionally # specify a particular hostname/port. Under Win32, the default hostnameis# '127.0.0.1', and the default port is 514. # # [Unix flavours should use this format...] # output alert_syslog: LOG_AUTH LOG_ALERT # # [Win32 can use any of these formats...] # output alert_syslog: LOG_AUTH LOG_ALERT # output alert_syslog: host=localhost, LOG_AUTH LOG_ALERT # output alert_syslog: host=hostname:port, LOG_AUTH LOG_ALERT Try this: output alert_syslog: host=hostname:port, LOG_AUTH LOG_ALERT HTH Matt Steve wrote:Hi, New to the list, new to Linux, new to Snort, but trying hard! I have installed Smoothwall Express V2, and I'm having fun setting things up and learning about all these things. But I'm stumped on one thing. I have Kiwi Syslog Daemon running on a w2k3 box receiving syslog messages from Smoothwall and Linux. I've changed syslog.conf to accomplish this, adding: *.* @192.168.0.60 at the end. Now all my Smoothwall logs are happily arriving at Kiwi. But I'd like to get Snort messages there too. I've changed snort.conf to uncomment the line: output alert_syslog: LOG_AUTH LOG_ALERT but don't see any Snort messages in syslog. What else do I need to do? I've trawled the web and archives but found nothing definitive, only lots of people asking similar questions. Sorry if this has been covered before. While I'm here, there is one other syslog-related problem, although not with Snort. After Smoothwall boot, it takes about 5 minutes for Kiwi to start receiving anything from Smoothwall, even though Smoothwall in the meantime logs messages. I have asked these questions on the Smoothwall list, but have received no answers, so hoping someone here can help. Cheers. *Steve*------------------------------------------------------- SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift. http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=ort-users------------------------------------------------------- SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift. http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list
---------------End of Original Message----------------- ------------------------------------------------------- SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift. http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Syslogging question Steve (Aug 22)
- Re: Syslogging question Matt (Aug 23)
- RE: Syslogging question Steve (Aug 23)
- <Possible follow-ups>
- RE: Syslogging question Steve (Aug 23)
- RE: Syslogging question Rich Adamson (Aug 24)
- RE: Syslogging question Steve (Aug 24)
- Re: Syslogging question Tony Carter (Aug 24)
- RE: Syslogging question Steve (Aug 24)
- RE: Syslogging question Rich Adamson (Aug 24)
- Re: Syslogging question Matt (Aug 23)