RE: Problems logging to syslog and mysql simultaneously

["Don" <Don () WeberOnTheWeb com>]

RE: [Snort-users] Problems logging to syslog and mysql simultaneouslyit
seems the only person it works for around here is M Steele.

Don

  -----Original Message-----
  From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net]On Behalf Of LaRose, Dallas
  Sent: Wednesday, June 26, 2002 8:17 AM
  To: snort-users () lists sourceforge net
  Subject: RE: [Snort-users] Problems logging to syslog and mysql
simultaneously


  Has anyone found any additional information on this problem?  Is anyone
else experiencing this?

  TIA,
  Dallas

  -----Original Message-----
  From: LaRose, Dallas [mailto:dlpassport () s2access com]
  Sent: Thursday, June 20, 2002 11:33 AM
  To: 'Michael Steele'
  Cc: snort-users () lists sourceforge net
  Subject: RE: [Snort-users] Problems logging to syslog and mysql simultaneo
usly



  Michael,

  Please see my notes below.  Were you able to reproduce the problem?

  Thanks,
  Dallas



  -----Original Message-----
  From: Michael Steele [mailto:michaels () silicondefense com]
  Sent: Thursday, June 20, 2002 9:25 AM
  To: dlpassport () s2access com
  Subject: RE: [Snort-users] Problems logging to syslog and mysql
simultaneously



  DL,

  We are working on this problem.

  1. You can log to local Syslog?
  *** Only when using -s ***

  Using what method?

  1. output alert_syslog: LOG_AUTH LOG_ALERT
     output alert_full
   *** This doesn't log at all ***

  2. -s xxx.xxx.xxx.xxx:xxx
  *** This works properly ***

  3. Item 2 is local or remote?
  *** When using a -s, this works locally and remotely ***

  -Michael
  --
   Michael Steele | System Engineer / Support Technician
mailto:michaels () silicondefense com
   Silicon Defense: IDS solutions - http://www.silicondefense.com
   Snort: Open Source Network IDS - http://www.snort.org




  -----Original Message-----
  From: snort-users-admin () lists sourceforge net
  [mailto:snort-users-admin () lists sourceforge net] On Behalf Of
dlpassport () s2access com
  Sent: Thursday, June 20, 2002 5:25 AM
  To: snort-users () lists sourceforge net
  Subject: RE: [Snort-users] Problems logging to syslog and mysql
simultaneously

  Per our discussion yesterday, I am still having similar problems.  I am
unable to log to a local syslog without a command line switch.

  The -s x.x.x.x:xxx does work on Win32... but when using this option, all
other outputs are disabled.  Even with the

  output alert_syslog: LOG_AUTH LOG_ALERT

  output alert_full

  in my snort.conf, I am still experiencing the problem.  Does anyone have a
snort.conf that works?  Is there any "order of operations" or sequence with
the conf options?

  Also.. Michael... the Kiwi syslog server does RegExp checking and can run
an executable based on a RegExp match.  Have this trip a batch file which
calls Blat to send an e-mail.  This should work well for you.  Not as clean
as swatch, but it works.

  Thanks... DL

  -----Original Message-----

  From: Steven Williams [mailto:Steven.Williams () computershare com au]

  Sent: Wednesday, June 19, 2002 9:33 PM

  To: 'snort-users () lists sourceforge net'

  Subject: [Snort-users] RE: Problems logging to syslog and mysql
simultaneously






  I've had exactly the same problem with my setup.

  I can get snort to log to either Syslog locally or remotely, but not at
the same time as logging to the remote database.

  I've tried both the -s options on the command line, and also Michaels
suggestions within snort.conf, but it will only let me have one or the
other, and the -s option does turn on or off the syslog option. Changing any
parameters with snort.conf don't seem to make any difference.

  This is with snort 1.8.7-MySQL-Win32 Build 121 on W2K Server, using Kiwi
Syslog Server Ver 6.4.9. I am logging remotely to another W2K server also
running the same version of Kiwi and MySql 3.23.40.

  Steve








  ---

  This email and any files transmitted with it are solely intended for the
use of the

  addressee(s) and may contain information that is confidential and
privileged. If you receive this email in error, please advise us by return
email immediately. Please also disregard the contents of the email, delete
it and destroy any copies immediately. Computershare Limited and its
subsidiaries do not accept liability for the views expressed in the email or
for the consequences of any computer viruses that may be transmitted with
this email

  This email is also subject to copyright. No part of it should be
reproduced, adapted or

  transmitted without the written consent of the copyright owner.






  -------------------------------------------------------

  Bringing you mounds of caffeinated joy

  >>> http://thinkgeek.com/sf <<<

  _______________________________________________

  Snort-users mailing list

  Snort-users () lists sourceforge net

  Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users

  Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users





  -------------------------------------------------------
                     Bringing you mounds of caffeinated joy
                     >>>     http://thinkgeek.com/sf    <<<

  _______________________________________________
  Snort-users mailing list
  Snort-users () lists sourceforge net
  Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
  Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users





  -------------------------------------------------------
                     Bringing you mounds of caffeinated joy
                     >>>     http://thinkgeek.com/sf    <<<

  _______________________________________________
  Snort-users mailing list
  Snort-users () lists sourceforge net
  Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
  Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users



  -------------------------------------------------------
  This sf.net email is sponsored by: Jabber Inc.
  Don't miss the IM event of the season | Special offer for OSDN members!
  JabConf 2002, Aug. 20-22, Keystone, CO http://www.jabberconf.com/osdn
_______________________________________________
  Snort-users mailing list
  Snort-users () lists sourceforge net
  Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
  Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users