Remote syslogging of snort

[Paul Schmehl <pauls () utdallas edu>]

I'm trying to set up snort to do remote sysloging.  So I put this line in 
the snort.conf file:

output alert_syslog: local1.debug

But when I restart snort, I get this error message in /var/log/messages:

WARNING /usr/local/etc/snort.conf (419) => Unrecognized syslog 
facility/priority: local1.debug

Does snort not recognize the local logging facilities?  Or do I have a 
syntax error?

(/etc/syslog.conf reads "local1.debug    @{sysloghost}

Sysloghost /etc/syslog.conf reads "local1.debug     /var/log/snort.log)

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/


-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 - 
digital self defense, top technical experts, no vendor pitches, 
unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users