RE: Remote syslogging of snort

["Esler, Joel - Contractor" <joel.esler () rcert-s army mil>]

Excerpt from Snort Users manual http://www.snort.org/docs

2.11 Output Modules

Output modules are new as of version 1.6. They allow Snort to be much
more flexible in the formatting and presentation of output to its users.
The output modules are run when the alert or logging subsystems of Snort
are called, after the preprocessors and detection engine. The format of
the directives in the rules file is very similar to that of the
preprocessors.

Multiple output plugins may be specified in the Snort configuration
file. When multiple plugins of the same type (log, alert) are specified,
they are stacked and called in sequence when an event occurs. As with
the standard logging and alerting systems, output plugins send their
data to /var/log/snort by default or to a user directed directory (using
the -l command line switch).

Output modules are loaded at runtime by specifying the output keyword in
the rules file:

output <name>: <options>

Figure 2.28: Output Module Configuration Example
\begin{figure}\begin{verbatim}output alert_syslog: LOG_AUTH
LOG_ALERT\end{verbatim}\par\end{figure}


2.11.1 Alert_syslog

This module sends alerts to the syslog facility (much like the -s
command line switch). This module also allows the user to specify the
logging facility and priority within the Snort rules file, giving users
greater flexibility in logging alerts.

2.11.1.1 Available keywords

2.11.1.1.1 Options

    * LOG_CONS
    * LOG_NDELAY
    * LOG_PERROR
    * LOG_PID

2.11.1.1.2 Facilities

    * LOG_AUTH
    * LOG_AUTHPRIV
    * LOG_DAEMON
    * LOG_LOCAL0
    * LOG_LOCAL1
    * LOG_LOCAL2
    * LOG_LOCAL3
    * LOG_LOCAL4
    * LOG_LOCAL5
    * LOG_LOCAL6
    * LOG_LOCAL7
    * LOG_USER

2.11.1.1.3 Priorities

    * LOG_EMERG
    * LOG_ALERT
    * LOG_CRIT
    * LOG_ERR
    * LOG_WARNING
    * LOG_NOTICE
    * LOG_INFO
    * LOG_DEBUG

-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of Paul
Schmehl
Sent: Wednesday, July 14, 2004 11:38 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] Remote syslogging of snort


I'm trying to set up snort to do remote sysloging.  So I put this line
in 
the snort.conf file:

output alert_syslog: local1.debug

But when I restart snort, I get this error message in /var/log/messages:

 WARNING /usr/local/etc/snort.conf (419) => Unrecognized syslog 
facility/priority: local1.debug

Does snort not recognize the local logging facilities?  Or do I have a 
syntax error?

(/etc/syslog.conf reads "local1.debug    @{sysloghost}

Sysloghost /etc/syslog.conf reads "local1.debug     /var/log/snort.log)

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/


-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training. Attend
Black Hat Briefings & Training, Las Vegas July 24-29 - 
digital self defense, top technical experts, no vendor pitches, 
unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_idG21&alloc_id040&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users