Re: change syslog messages

[MMartin () jwpepper com]

Hey Luis, I'm new to snort myself so if I'm wrong I'm sure someone will 
correct me..

But in your Config file (*/etc/snort/snort.conf most likely) you should 
have a section for Logging. I believe you can specify the log file output 
format in the config file, and on the command line you can specify where 
to log by using the -l option. I believe if you specify an output FORMAT, 
you can also specify a pattern for which the log file will be named. For 
example, the line below is from MY config file, which will create a 
filename using the format "snort.u2".

> From Config File:
        output unified2: filename snort.u2, limit 128

*This will output in the Unified2 format, aka binary mode...


Snort Command, like so:
         /usr/local/bin/snort -c /etc/snort/snort.conf  -i eth0  -l 
/var/log/snort  .....more options..... -b

Since I chose to log in binary mode (aka Unified2 mode) I would include 
the "-b" option on the command line.
So this will begin logging to a file in the directory /var/log/snort. And 
I think by default (*at least for me) it will log to a file that looks 
like: 
        /var/log/snort/snort.u2.#######

Where the "#######" symbols are actually numbers representing the 
timestamp for when snort was started. And I think if you DO NOT specify an 
option like the "-b" option for binary mode and you didn't have the line 
from above, under "From Config File:", it will log in plain text... I 
think? To a file that looks like:
        /var/log/snort/snort.log.#######

Hope that helps!

Thanks,
Matt





From:   "Budinich Galvez, Luis Alberto" <BUDINIL () 3p mapfre com>
To:     "'snort-users () lists sourceforge net'" 
<snort-users () lists sourceforge net>
Date:   03/11/2014 12:41 PM
Subject:        [Snort-users] change syslog messages



Hello, snort users!!!
 
I want to ask if would be possible to send all snort syslog-messages to 
another log file (not /var/log/messages). ¿ What do you think?
 
Regards.
Luis Budinich.
 
------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort 
news!

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!