Re: Unrecognised syslog facility/priority in snort

[Mayur Patil <ram.nath241089 () gmail com>]

Hi,

    I tried your all steps:

    1.  I have disabled firewalls on all systems.

    2.  I am also able to send message through *nc *and* telnet*.

    In My Opinion, syslog is working fine. As even if I log messages on
client, they export to rSyslog server as per configuration.

    For ex, my client(snort machine) is 172.20.54.211  and server is
172.20.54.213 (rSyslog server)

    If I send some message to 172.20.54.211, it will appear in syslog of
rSyslog server.

    3. I have also added line to /etc/rsyslog.conf

       *  *.*                                                     @
172.20.54.213:514*

     still not getting alerts in syslog of remote log server.

    The thing I noticed:

    When I restart snort from command line, I am *not seeing message
*"unrecognized
syslog facility/priority: host=172.20.54.213:514,"

*    in server syslog.*

    If I run snort in NIDS mode, it gives error in the same snort console,
"unrecognized syslog facility/priority: host=172.20.54.213:514,"

    Now what are the next steps please help ??

    I am attaching snort and rsyslog conf files.

    Seeking for the guidance,

    Thanks !!
*
--
*
*Cheers,
*
*Mayur*

On Fri, Sep 6, 2013 at 9:13 PM, praveen_recker . <praveen_recker () sify com>wrote:

> Hi Mayur,
>
> On Snort(172.20.54.211) setup add
>
> Modify syslog configuration file
>                  /etc/rsyslog.conf
> by adding line
> *.*                                                     @172.20.54.213:514
>
> I am not sure what is the use of "172.20.54.212 - other client".
> Your Snort (172.20.54.211) setup will act as client and machine with
> syslog acts as Server(172.20.54.213).
>
> Best Regards,
> Praveen Darshanam
>
>
> On Fri, Sep 6, 2013 at 12:33 PM, Mayur Patil <ram.nath241089 () gmail com>wrote:
>
> > Hi Pravin,
> >
> >    I am attaching the output of following files
> >
> >      [1] rsyslog.conf of client machine  http://fpaste.org/37490/
> >
> >      [2] rsyslog.conf of server machine http://fpaste.org/37491/
> >
> >      [3] snort.conf:  http://fpaste.org/37493/
> >
> >   I am stuck on this issue. Please help !!
> >
> >   I am getting snort.log files on remote server when I restart snort.
> >
> >   but unable to get "alert" files log which is the utmost important part
> >
> >   172.20.54.211 -  snort machine
> >
> >   172.20.54.212 - other client
> >
> >   172.20.54.213- server machine
> >
> >   Thanks !*
> >
> > *
> > *--
> > *
> > *Cheers,
> > Mayur*

Attachment: rsyslog for server.conf
Description:

Attachment: rsyslog for snort.conf
Description:

Attachment: snort.conf
Description:

------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!