Snort mailing list archives
RE: Snort ---> syslog
From: "Michael Steele" <michaels () silicondefense com>
Date: Fri, 21 Jun 2002 07:43:33 -0700
Spyguy, When you select Syslog you get 1 line of alert and that line is limited to a number of characters. You will get a lot more information from the console manager you are using. You can use spade to do correlations, and there are others. You can send the Syslog to a remote Syslog server, and use Swatch to email alerts, this is the way to do it, or use Swatch on the local Syslog, but of course this is *nix specific. Swatch won't run on Windows :( -Michael -- Michael Steele | System Engineer / Support Technician mailto:michaels () silicondefense com Silicon Defense: IDS solutions - http://www.silicondefense.com Snort: Open Source Network IDS - http://www.snort.org -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of spy Sent: Wednesday, May 22, 2002 8:05 AM To: snort-users () lists sourceforge net Subject: [Snort-users] Snort ---> syslog Anyone have any experience with snort logging to syslog? I have a few questions before i 'try' it. 1) Are logs and alerts LACKING useful data that you would normally get with regular snort logging? 2) Are you using any correlation tools like NetForensics or something else? 3) Can you send syslog from multiple snort sensors to one syslog server and run swatch? If yes, what do you like/not like about doing it this way? Thanks in advance! spyguy ------------------------------------------------------- Sponsored by: ThinkGeek at http://www.ThinkGeek.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- Sponsored by: ThinkGeek at http://www.ThinkGeek.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort ---> syslog spy (Jun 20)
- RE: Snort ---> syslog Michael Steele (Jun 21)
- RE: Snort ---> syslog Don (Jun 21)
- RE: Snort ---> syslog Michael Steele (Jun 21)
- RE: Snort ---> syslog Don (Jun 21)
- RE: Snort ---> syslog Michael Steele (Jun 21)