Fwd: Unrecognised syslog facility/priority in snort

[Mayur Patil <ram.nath241089 () gmail com>]

Hi Praveen Sir,

  Great Troubleshoot !!

  By your said solution, when I filtered traffic with

  "udp.port==514" , I am able to see snort logs alerts on both machines.

  On snort machine, I am seeing alert at:

  1. /var/log/snort/alert location
  2. wireshark filter

  On rsyslog server (Ubuntu machine),

  *Only at wireshark.*

  The only *problem* is

  *The rsyslog server machine is capturing snort alerts (which I can see in
wireshark)

  but not logging same into the syslog file (at location /var/log/syslog).

*
*  *I have really no idea what is stopping syslog to log alerts and I am
just one step away,

  Please help how to solve this,

  Seeking for guidance,

  Thanks !!
*
*
*
P.S. I have attached snort and rsyslog conf files.
*
*--
*
*Cheers,
*
*Mayur*.




On Sat, Oct 5, 2013 at 10:00 AM, praveen_recker .
<praveen_recker () sify com>wrote:
> > are u able to ping from 172.20.54.211  to 172.20.54.213 and viceversa
> > once rsyslog configuration is done restart rsyslog service
> > on 172.20.54.213 run netstat -anu and check if 514/UDP is up
> > on snort machine and rsyslog server machine start Wireshark with a filter
> > "udp.port==514" and check for alerts
> >
> > Let me know the output of above steps
> >
> > Best Regards,
> > Praveen Darshanam
> >
> >
> >
> > On Fri, Oct 4, 2013 at 1:50 PM, Mayur Patil <ram.nath241089 () gmail com>wrote:
> > Hi,
> >
> >     I tried your all steps:
> >
> >     1.  I have disabled firewalls on all systems.
> >
> >     2.  I am also able to send message through *nc *and* telnet*.
> >
> >     In My Opinion, syslog is working fine. As even if I log messages on
> > client, they export to rSyslog server as per configuration.
> >
> >     For ex, my client(snort machine) is 172.20.54.211  and server is
> > 172.20.54.213 (rSyslog server)
> >
> >     If I send some message to 172.20.54.211, it will appear in syslog of
> > rSyslog server.
> >
> >     3. I have also added line to /etc/rsyslog.conf
> >
> >        *  *.*                                                     @
> > 172.20.54.213:514*
> >
> >      still not getting alerts in syslog of remote log server.
> >
> >     The thing I noticed:
> >
> >     When I restart snort from command line, I am *not seeing message *"unrecognized
> > syslog facility/priority: host=172.20.54.213:514,"
> >
> > *    in server syslog.*
> >
> >     If I run snort in NIDS mode, it gives error in the same snort
> > console, "unrecognized syslog facility/priority: host=172.20.54.213:514,"
> >
> >     Now what are the next steps please help ??
> >
> >     I am attaching snort and rsyslog conf files.
> >
> >     Seeking for the guidance,
> >
> >     Thanks !!
> > **
> > On Fri, Sep 6, 2013 at 9:13 PM, praveen_recker . <praveen_recker () sify com
> > > wrote:
> > Hi Mayur,
> >
> > On Snort(172.20.54.211) setup add
> >
> > Modify syslog configuration file
> >                  /etc/rsyslog.conf
> > by adding line
> > *.*                                                     @172.20.54.213
> > :514
> >
> > I am not sure what is the use of "172.20.54.212 - other client".
> > Your Snort (172.20.54.211) setup will act as client and machine with
> > syslog acts as Server(172.20.54.213).
> >
> > Best Regards,
> > Praveen Darshanam
> >
> >
> > On Fri, Sep 6, 2013 at 12:33 PM, Mayur Patil <ram.nath241089 () gmail com>wrote:
> > Hi Pravin,
> >
> >    I am attaching the output of following files
> >
> >      [1] rsyslog.conf of client machine  http://fpaste.org/37490/
> >
> >      [2] rsyslog.conf of server machine http://fpaste.org/37491/
> >
> >      [3] snort.conf:  http://fpaste.org/37493/
> >
> >   I am stuck on this issue. Please help !!
> >
> >   I am getting snort.log files on remote server when I restart snort.
> >
> >   but unable to get "alert" files log which is the utmost important part
> >
> >   172.20.54.211 -  snort machine
> >
> >   172.20.54.212 - other client
> >
> >   172.20.54.213- server machine
> >
> >   Thanks !

Attachment: rsyslog for server.conf
Description:

Attachment: rsyslog for snort.conf
Description:

Attachment: snort.conf
Description:

------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!