Snort mailing list archives
Re: Syslog Help
From: Kevin Ross <kevross33 () googlemail com>
Date: Wed, 20 Mar 2013 11:39:54 +0000
Ok I have tried and nothing on loopback :( I am sure this is working because other logging formats work so just not syslog. I have attached my recent barnyard2.conf file and I think I already posted what it is running as. I ran test like this with it configured as output alert_syslog_full: sensor_name SENSORNAME, server 127.0.0.1, protocol udp, port 514, operation_mode default and so on as shown below: 1) test logging snort -r /etc/snort/pcaps/kelihos.pcap -c /etc/snort/snort.conf -A console -- OMMITED ---- OMMITED ET TROJAN Win32/Kelihos.F Checkin 7 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} OMMITED:1031 -> OMMITED:80 OMMITED [**] [1:2012707:2] ET CURRENT_EVENTS Suspicious double HTTP Header possible botnet CnC [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} OMMITED:80 -> OMMITED:1031 2) Set tcpdump tcpdump -vvv -i lo -A -s 1524 -n 'port 514' 3) Ran again: snort -r /etc/snort/pcaps/kelihos.pcap -c /etc/snort/snort.conf 4) confirmed it logged to mysql database. 5) I have left it all running for a while with "normal" alerts being generated off passive interface and it logs to database fine but never sends syslog. I have confirmed this issue on 2 different sensors I want this to run on. 1) Snort listening to passive interface. However; in tests I am using PCAPs of malware activity to generate alerts. 2) Snort writes to unified2 3) Barnyard 2 is picking up unified to log and writing to a remote database so I can view it there. I have been using it this way for years with no issue. 4) It now has the following line in but it doesn't work. Here is what I have tried: output alert_syslog_full: sensor_name SENSORNAME, server 127.0.0.1, protocol udp, port 514, operation_mode default output alert_syslog_full: sensor_name SENSORNAME, server 127.0.0.1, protocol udp, port 514, operation_mode complete output alert_syslog_full: sensor_name SENSORNAME, server 127.0.0.1, protocol udp, port 514, LOG_LOCAL1, operation_mode default output alert_syslog_full: sensor_name SENSORNAME, server 127.0.0.1, protocol udp, port 514, LOG_LOCAL1, operation_mode complete output alert_syslog_full: sensor_name SENSORNAME, server REAL_SERVER, protocol udp, port 514, operation_mode default output alert_syslog_full: sensor_name SENSORNAME, server REAL_SERVER, protocol udp, port 514, operation_mode complete output alert_syslog_full: sensor_name SENSORNAME, server REAL_SERVER, protocol udp, port 514, LOG_LOCAL1, operation_mode default output alert_syslog_full: sensor_name SENSORNAME, server REAL_SERVER, protocol udp, port 514, LOG_LOCAL1, operation_mode complete 5) Routes are fine from these servers and I can ping, connect other ports on syslog server etc. Syslog server known to be working as it is taking in firewall logs and other things using different methods. 6) I have following syslog package installed on client system which is currently running Fedora 15 although this will be getting changed soon. # rpm --query rsyslog rsyslog-5.8.7-1.fc15.i686 # yum list *syslog* Installed Packages (I then install syslog-ng in case) rsyslog.i686 5.8.7-1.fc15 @updates syslog-ng.i686 3.2.5-2.fc15 @updates Available Packages erlang-erlsyslog.i686 0.1-6.fc15 fedora perl-Unix-Syslog.i686 1.1-7.fc15 fedora rsyslog-gnutls.i686 5.8.7-1.fc15 updates rsyslog-gssapi.i686 5.8.7-1.fc15 updates rsyslog-libdbi.i686 5.8.7-1.fc15 updates rsyslog-mysql.i686 5.8.7-1.fc15 updates rsyslog-pgsql.i686 5.8.7-1.fc15 updates rsyslog-relp.i686 5.8.7-1.fc15 updates rsyslog-snmp.i686 5.8.7-1.fc15 updates rsyslog-udpspoof.i686 5.8.7-1.fc15 updates sblim-cmpi-syslog.i686 0.8.0-2.fc15 fedora sblim-cmpi-syslog-test.i686 0.8.0-2.fc15 fedora syslog-ng.i686 3.2.5-2.fc15 updates syslog-ng-devel.i686 3.2.5-2.fc15 updates syslog-ng-libdbi.i686 3.2.5-2.fc15 updates 7) I have completely reinstalled everything (Snort, barnyard etc). Barnyard is configured with ./configure --with-mysql. So is there anything else I should be looking for? Thanks, Kevin On 19 March 2013 17:48, beenph <beenph () gmail com> wrote:
On Mon, Mar 18, 2013 at 8:20 AM, Kevin Ross <kevross33 () googlemail com> wrote:Hi, I usually use unified 2 to barnyard which sends logs into mysql. Now Ihavethe need to send Syslog into another log collector. I haven't used syslog for snort output in a while but I have never had these issues before. I have configured the syslog output in multiple ways and even thoughalertsare processed and sent into mysql database it never generates syslogalerts.I have captured traffic with tcpdump from the box and nothing is sent.Doesanyone have any ideas what is needed? I just need it to send genericsyslog(and I have checked the usual, network connectivity the collector isthere,firewalls not in way etc). Strange thing is when run in continuous modeitsays it is using syslog and has the IP, port, mode etc. Thanks for any help, Kevin output alert_syslog_full: sensor_name NAME, server 10.X.X.X.X, protocoludp,port 514, operation_mode default (tried complete and other options too) # snort -V ,,_ -*> Snort! <*- o" )~ Version 2.9.4.1 GRE (Build 69) '''' By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using libpcap version 1.1.1 Using PCRE version: 8.12 2011-01-15 Using ZLIB version: 1.2.5 # barnyard2 -V ______ -*> Barnyard2 <*- / ,,_ \ Version 2.1.12 (Build 321) |o" )~| By Ian Firns (SecurixLive): http://www.securixlive.com/ + '''' + (C) Copyright 2008-2013 Ian Firns <firnsy () securixlive com> # ps aux | grep barn root 18725 77.4 3.6 91792 73064 ? Rs 12:11 2:29 /usr/local/bin barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort/-fsnort.u2 -w /var/log/snort/bylog.waldo -D # ps aux | grep snort snort 18698 73.3 16.1 745592 325160 ? Rsl 12:11 2:53 /usr/local/bin snort -D -i em1 -u snort -g snort -c/etc/snort/snort.conf -l/var/log/snort/Are you sure your listening to the good interface and that your routing table is fine for your destination syslog system? #From conf for testing output alert_syslog_full: sensor_name NAME, server 127.0.0.20, protocol udp, port 514, operation_mode default output log_syslog_full: sensor_name NAME, server 127.0.0.20, protocol udp, port 514, operation_mode complete root@SINGULAR:~# tcpdump -vvv -i lo -A -s 1524 -n 'port 514' tcpdump: listening on lo, link-type EN10MB (Ethernet), capture size 1524 bytes 13:16:38.168132 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 124) 127.0.0.1.59741 > 127.0.0.20.514: [bad udp cksum 0xfe8e -> 0x4a72!] [|syslog] E..|..@.@.<\.........]...h..[1:2008017:3] Snort Alert [1:1:3] [Priority: 1]: {ICMP} 1.1.1.1:0 -> 1.1.1.1:0. 13:16:38.169031 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 370) 127.0.0.1.51788 > 127.0.0.20.514: [bad udp cksum 0xff84 -> 0x9663!] [|syslog] E..r..@.@.;f.........L...^..| [SNORTIDS[LOG]: [NAME] ] || 2013-03-14 12:41:48.607+-04 1 [1:1:3] Snort Alert [1:1:3] || [Unknown Classification] || 1 1.1.1 1.1.1.1 5 0 0 39 24721 0 0 12495 0 || 0 0 15293 29288 0 || 60 00E020110A95001109CF555608004500002760910000400130CF0AC800346F6F6F0B00003BBD7268000048656C6C6F2C576F726C6400000000000000 || |. Seems to work as expected here. Can you try with loopback first? Cheers, -elz
Attachment:
barnyard2.conf
Description:
------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_d2d_mar
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Syslog Help Kevin Ross (Mar 18)
- Re: Syslog Help Peter Bates (Mar 18)
- Re: Syslog Help Joel Esler (Mar 18)
- Re: Syslog Help Kevin Ross (Mar 18)
- Re: Syslog Help Joel Esler (Mar 18)
- Re: Syslog Help beenph (Mar 19)
- Re: Syslog Help Kevin Ross (Mar 20)
- Re: Syslog Help beenph (Mar 20)
- Re: Syslog Help Kevin Ross (Mar 20)
- Re: Syslog Help Peter Bates (Mar 18)