Snort mailing list archives
RE: Snort not logging....
From: "Mike Koponick" <mike () redhawk info>
Date: Sun, 5 Jan 2003 09:24:13 -0800
Andrew, Thanks for the advice... your suggestion seems to be working just fine. Mike -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net]On Behalf Of Andrew R. Baker Sent: Saturday, January 04, 2003 12:17 PM To: Mike Koponick Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] Snort not logging.... Mike Koponick wrote:
Hello, I know this has been discussed, and discussed... but I'm a little lost. I have SNORT configured to log to /var/log/snort/snort.log, however, everything goes to var/log/messages instead. I would rather keep the Snort logs seperate for parsing purposes. I'm running RH 8.0 and Snort 1.9. Here is a glimps into my config: In my snort.conf file I have: # alert_syslog: log alerts to syslog # ---------------------------------- # Use one or more syslog facilities as arguments # output alert_syslog: LOG_AUTH LOG_ALERT
Well, here you are telling Snort that all alerts should get logged via your systems syslog mechanism.
Here is my startup script: INTERFACE=eth1 CONFIG=/etc/snort/snort.conf # See how we were called. case "$1" in start) echo -n "Starting snort: " ifconfig $INTERFACE promisc daemon /usr/local/bin/snort -U -o -z -i $INTERFACE -d -D -c $CONFIG -l /var/log/snort/snort.log
And here you are telling Snort to use the directory "/var/log/snort/snort.log" for any *files* it creates for alerts and packet logs. So, you need to either change Snort to use a different output mechanism (such as alert_fast or alert_full) or edit /etc/syslog.conf to direct syslog notices to the AUTH facility with the ALERT priority to a file other than messages (which may also cause *other* programs to send message there). From what little you have said about what you want, I would suggest doing the following: 1) Comment out the "output alert_syslog" line in snort.conf 2) Add this line to snort.conf: output alert_fast: snort.log 3) Change the argument to -l in the startup script to "/var/log/snort" 4) Make sure the directory /var/log/snort exists. -A ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- flexresp and libnet Hauser Marcel (Jan 03)
- Re: flexresp and libnet James-lists (Jan 04)
- Snort not logging.... Mike Koponick (Jan 04)
- Re: Snort not logging.... Andrew R. Baker (Jan 04)
- RE: Snort not logging.... Mike Koponick (Jan 05)
- Bad Protocol? Mike Koponick (Jan 05)
- Re: Bad Protocol? J Irving (Jan 05)
- Snort not logging.... Mike Koponick (Jan 04)
- Re: flexresp and libnet James-lists (Jan 04)