Re: Using syslogd more efficiently

[Demetri Mouratis <dmourati () cm math uiuc edu>]

First thing to look at is how your snort.conf defines its logging output:

output alert_syslog: LOG_AUTH LOG_ALERT

LOG_AUTH and LOG_ALERT are the log facility and  priority.

Now look at /etc/syslog.conf for the output corresponding to the
auth/alert facility and priority:

auth.alert                                      /var/log/snortlog

Then restart syslogd and start tailing your logs.

Look at man syslog.conf for more info.

Hope that helps.
On Mon, 25 Nov 2002, Pauling wrote:

> I've been trying to do this for a while, but to no success,
> I like the output format that the syslogd output comes in, but I don't
> want it to dump to /var/log/messages
>
> Anybody here know how to configure this so that snort messages go to a
> different log file?
>
> --
> Frank Barton
> Starwolf.biz Systems Administrator
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

---------------------------------------------------------------------
Demetri Mouratis
dmourati () linfactory com



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users