Snort mailing list archives
RE: [Snort-Users] differentiate between eth0 and eth1 in logs
From: Matt Kettler <mkettler () evi-inc com>
Date: Fri, 02 Apr 2004 11:11:39 -0500
At 08:52 AM 4/2/2004, Jim Hendrick wrote:
There was some talk about a year ago about allowing the user to specify what syslog facility snort would use. I don't think this made it into the code, but adding it should not be too hard. Other possibilities are to log to two separate files (the -l flag) and then parsing those with something to separate the alerts.
It's in snort 2.1, and may also be in earlier versions.. it's just a parameter to the output plugin in snort.conf
To quote snort.conf: # [Unix flavours should use this format...] # output alert_syslog: LOG_AUTH LOG_ALERT And spo_alert_syslog.c has code to support this...So, he could do the two separate config files idea I posted earlier, and still use syslog.. one logging to LOG_LOCAL5 and one to LOG_LOCAL4.. then configure syslog to dump them into separate logfiles. (and before anyone asks: No, snort can't tell syslog what file to use.. that's not how syslog works)
------------------------------------------------------- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- [Snort-Users] differentiate between eth0 and eth1 in logs eamonn doyle (Apr 01)
- RE: [Snort-Users] differentiate between eth0 and eth1 in logs Jim Hendrick (Apr 02)
- RE: [Snort-Users] differentiate between eth0 and eth1 in logs Matt Kettler (Apr 02)
- Re: [Snort-Users] differentiate between eth0 and eth1 in logs Edin Dizdarevic (Apr 02)
- Re: [Snort-Users] differentiate between eth0 and eth1 in logs eamonn doyle (Apr 02)
- RE: [Snort-Users] differentiate between eth0 and eth1 in logs Jim Hendrick (Apr 02)