Snort mailing list archives
RE: Syslogging question
From: "Steve" <snort () dawson family name>
Date: Wed, 25 Aug 2004 12:51:20 +1000
Yep, done that. And all my other syslog messages are making it to the host. I just don't think Snort is delivering any messages to syslog. Steve
-----Original Message----- From: Tony Carter [mailto:tcarter () entrusion com] Sent: Wednesday, 25 August 2004 11:47 AM To: Steve Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] Syslogging question Make sure that you have tabs between *.* and @192.168.0.60. -Tony On Aug 24, 2004, at 6:52 PM, Steve wrote:Rich, I *think* I've done all that. I've uncommented the "output syslog_alert" line in snort.conf, so alerts should be going to syslog. I've added the line to syslog.conf to forward to my host (and that's working because I get lots of other messages forwarded just fine). It forwards ALL messages (*.*). Even rebooted after all changes to be sure. There must be something else I need to change in Snort to get alerts sent to syslog. Who knows what? Steve-----Original Message----- From: Rich Adamson [mailto:radamson () routers com] Sent: Tuesday, 24 August 2004 10:14 PM To: snort-users () lists sourceforge net; Steve Subject: RE: [Snort-users] Syslogging question Steve, Not sure what all you've tried, but consider... 1. use the snort.conf to send the alerts to the linux syslog facility, 2. configure the linux syslog facility to "handle" the incoming snort alerts 3. restart linux syslogd (required to reread config changes) 4. verify the linux syslogd is actually writing to a /var/log... file 5. when that is working, then add a linux syslog.conf statement (leave snort.conf alone) to forward these incoming messages to a distant machine (kiwi syslog). The syntax is something like "kern.crit @kiwi.machine.com" and can be found in 'man syslog.conf'. 6. when all of that is working, then try messing around with forwarding syslog messages directly from snort to kiwi, bypassing linux syslogd. I use snort on win32 with syslog a lot (for low volume sensors), but not on linux systems. I faintly recall (from a long time ago) that snort on linux writes the syslog messages via the linux OS calls (not the ip stack), and likely requires you config to first write the alerts to the linux syslog. All unix systems that I'm familiar with have a syslog config option to forward syslog messages to a distant machine "after" the unix syslog function receives the message. Remember any changes to /etc/syslog.conf requires a restart of the linux syslogd. Rich ------------------------Tried it just then, but still no messages in syslog... Steve-----Original Message----- From: Matt [mailto:matt () bfinity kicks-ass net] Sent: Tuesday, 24 August 2004 1:18 PM To: Steve Subject: Re: [Snort-users] Syslogging question Sorry I Didnt read, :) just for curiosity sake did you try it? Steve wrote:Matt, As I read it, the host= format only applies to the win32 version, nottheUnix version... Steve-----Original Message----- From: Matt [mailto:matt () bfinity kicks-ass net] Sent: Monday, 23 August 2004 3:14 PM To: Steve Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] Syslogging question ################################################################## ## # Step #3: Configure output plugins # # Uncomment and configure the output plugins you decide to use.General# configuration for output plugins is of the form: # # output <name_of_plugin>: <configuration_options> # # alert_syslog: log alerts to syslog # ---------------------------------- # Use one or more syslog facilities as arguments. Win32 can also optionally # specify a particular hostname/port. Under Win32, the defaulthostnameis# '127.0.0.1', and the default port is 514. # # [Unix flavours should use this format...] # output alert_syslog: LOG_AUTH LOG_ALERT # # [Win32 can use any of these formats...] # output alert_syslog: LOG_AUTH LOG_ALERT # output alert_syslog: host=localhost, LOG_AUTH LOG_ALERT # output alert_syslog: host=hostname:port, LOG_AUTH LOG_ALERT Try this: output alert_syslog: host=hostname:port, LOG_AUTH LOG_ALERT HTH Matt Steve wrote:Hi, New to the list, new to Linux, new to Snort, but trying hard! I have installed Smoothwall Express V2, and I'm having fun setting things up and learning about all these things. But I'm stumped ononething. I have Kiwi Syslog Daemon running on a w2k3 box receiving syslog messages from Smoothwall and Linux. I've changed syslog.conftoaccomplish this, adding: *.* @192.168.0.60 at the end. Now all my Smoothwall logs are happily arriving atKiwi.But I'd like to get Snort messages there too. I've changedsnort.confto uncomment the line: output alert_syslog: LOG_AUTH LOG_ALERT but don't see any Snort messages in syslog. What else do I need todo?I've trawled the web and archives but found nothing definitive,onlylots of people asking similar questions. Sorry if this has been covered before. While I'm here, there is one other syslog-related problem, although not with Snort. After Smoothwall boot, it takes about 5 minutes for Kiwi to start receiving anything from Smoothwall, even though Smoothwall in the meantime logs messages. I have asked these questions on the Smoothwall list, but havereceivedno answers, so hoping someone here can help. Cheers. *Steve*------------------------------------------------------- SF.Net email is sponsored by Shop4tech.com-Lowest price on BlankMedia100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift. http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=ort-users------------------------------------------------------- SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift. http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list---------------End of Original Message------------------------------------------------------------------------ SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift. http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift. http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Syslogging question Steve (Aug 22)
- Re: Syslogging question Matt (Aug 23)
- RE: Syslogging question Steve (Aug 23)
- <Possible follow-ups>
- RE: Syslogging question Steve (Aug 23)
- RE: Syslogging question Rich Adamson (Aug 24)
- RE: Syslogging question Steve (Aug 24)
- Re: Syslogging question Tony Carter (Aug 24)
- RE: Syslogging question Steve (Aug 24)
- RE: Syslogging question Rich Adamson (Aug 24)
- Re: Syslogging question Matt (Aug 23)