Snort mailing list archives
Re: Unrecognised syslog facility/priority in snort
From: "praveen_recker ." <praveen_recker () sify com>
Date: Wed, 4 Sep 2013 19:51:45 +0530
I don't think syslog is anyway dependent on mysql. There might be some issue in syslog configuration like missing ports, IP's,protocols etc. Best Regards, Praveen Darshanam On Wed, Sep 4, 2013 at 3:57 PM, Mayur Patil <ram.nath241089 () gmail com>wrote:
hello pravin I have not setup mysql database for snort; does it making unrecognized syslog facilty as like baynard2 ?? please guide ! Thanks ! On Fri, Aug 2, 2013 at 12:17 PM, praveen_recker . <praveen_recker () sify comwrote:Check if Firewall is running on any of the machines....turn it off. try to telnet/nc on to the port.....from snotr machine to syslog server port, it should be successful. -Praveen On Fri, Aug 2, 2013 at 10:42 AM, Mayur Patil <ram.nath241089 () gmail com>wrote:Hello Pravin, I have tried your steps. I am getting snort logs when snort restarts only on the remote rSyslog server. The problems I am facing are: 1. I am not getting logs of alert on remote rSyslog server. 2. When I tried command snort -c /etc/snort/snort.conf -i eth0 snort is able to start in NIDS mode but it still gives error of unrecognised syslog facility host: ip:port What am I doing wrong ?? Please guide, Thanks ! *-- Cheers, Mayur*. On Fri, Aug 2, 2013 at 1:05 AM, praveen_recker . < praveen_recker () sify com> wrote:Hi Mayur, Try to follow steps given in below link. http://darshanams.blogspot.in/2011/05/snort-logging-alerts-to-syslog-server.html Best Regards, Praveen darshanam On Thu, Aug 1, 2013 at 4:04 PM, Mayur Patil <ram.nath241089 () gmail com>wrote:Hello, I have done a lot google but found post mostly regarding Barnyard; not specific to Snort I also tried various blog post for remote rSyslog exportation but not getting answer for this. I set logs exportation settings as per manual of snort output alert_syslog: host=10.1.1.1:514, <facility> <priority> <options> So, in snort.conf file #syslog output alert_syslog: host=ip:port, LOG_AUTH LOG_ALERT it gives error of unrecognised facility when I run snort in NIDS mode. But it does not give error for output alert_syslog: LOG_AUTH LOG_ALERT What is going wrong ? Please guide. Thanks !! P.S. : Snort.conf file : http://pastebin.com/dkMRrfxp ---- *Yours Sincerely, Mayur* S. Patil, ME COMP ENGG, MITCOE, Pune. Contact : * * <https://www.facebook.com/mayurram> <https://twitter.com/RamMayur> <https://plus.google.com/u/0/107426396312814346345/about> <http://in.linkedin.com/pub/mayur-patil/35/154/b8b/> <http://stackoverflow.com/users/1528044/rammayur> * <https://myspace.com/mayurram>* <https://github.com/ramlaxman>
------------------------------------------------------------------------------ Learn the latest--Visual Studio 2012, SharePoint 2013, SQL 2012, more! Discover the easy way to master current and previous Microsoft technologies and advance your career. Get an incredible 1,500+ hours of step-by-step tutorial videos with LearnDevNow. Subscribe today and save! http://pubads.g.doubleclick.net/gampad/clk?id=58040911&iu=/4140/ostg.clktrk
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Unrecognised syslog facility/priority in snort Mayur Patil (Aug 01)
- Unrecognised syslog facility/priority in snort Mayur Patil (Aug 01)
- Re: Unrecognised syslog facility/priority in snort praveen_recker . (Aug 01)
- Re: Unrecognised syslog facility/priority in snort Mayur Patil (Aug 01)
- Message not available
- Re: Unrecognised syslog facility/priority in snort Mayur Patil (Sep 04)
- Re: Unrecognised syslog facility/priority in snort praveen_recker . (Sep 04)
- Re: Unrecognised syslog facility/priority in snort Mayur Patil (Sep 06)
- Re: Unrecognised syslog facility/priority in snort praveen_recker . (Sep 06)
- Re: Unrecognised syslog facility/priority in snort Mayur Patil (Aug 01)