Re: Unrecognised syslog facility/priority in snort

[Mayur Patil <ram.nath241089 () gmail com>]

Hi Praveen sir,

    here are my results:




    Check on your windows machine if UDP/514 is open by using netstat
> command.
>     From your snort machine try to do nc/telnet to UDP port 514.....Does
> it succeed?

   I am using *CentOS for snort machine* and *Ubuntu for rsyslog server.*

  [1] For nc and telnet,

   This is the successful output of telnet and nc  http://fpaste.org/45010/
these messages are appearing in syslog of log server.

  [2] For netstat command,

   This are the results of netstat particularly on 514 port
http://fpaste.org/45016/

  where  *[root@clc]* is *snort machine* and *[root@logserver]* is the *log
server machine*.






>    What is rsyslog for snort.conf and snort.conf....there should be single
> snort.conf file!!


  Sorry for the typos. The rsyslog for snort.conf means rSyslog.conf file
for Snort machine.


  I have also disabled the firewall. Problem is *"Wireshark is capturing
but syslog is not logging"*

  Seeking for guidance,

  Thanks !!
*
--
*
*Cheers,
*
*mayur*






On Tue, Oct 8, 2013 at 9:32 AM, praveen_recker . <praveen_recker () sify com>wrote:

> Hi Mayur,
>
> Check on your windows machine if UDP/514 is open by using netstat command.
> From your snort machine try to do nc/telnet to UDP port 514.....Does it
> succeed?
>
> What is rsyslog for snort.conf and snort.conf....there should be single
> snort.conf file!!
>
> Cheers,
> Praveen Darshanam
>
>
> On Mon, Oct 7, 2013 at 3:21 PM, Mayur Patil <ram.nath241089 () gmail com>wrote:
>
> > Hi Praveen Sir,
> >
> >   Great Troubleshoot !!
> >
> >   By your said solution, when I filtered traffic with
> >
> >   "udp.port==514" , I am able to see snort logs alerts on both machines.
> >
> >   On snort machine, I am seeing alert at:
> >
> >   1. /var/log/snort/alert location
> >   2. wireshark filter
> >
> >   On rsyslog server (Ubuntu machine),
> >
> >   *Only at wireshark.*
> >
> >   The only *problem* is
> >
> >   *The rsyslog server machine is capturing snort alerts (which I can see
> > in wireshark)
> >
> >   but not logging same into the syslog file (at location /var/log/syslog).
> >
> > *
> > *  *I have really no idea what is stopping syslog to log alerts and I am
> > just one step away,
> >
> >   Please help how to solve this,
> >
> >   Seeking for guidance,
> >
> >   Thanks !!
> > *
> > *
> > *
> > P.S. I have attached snort and rsyslog conf files.
> > *
> > *--
> > *
> > *Cheers,
> > *
> > *Mayur*.
> >
> >
> >
> >
> > On Sat, Oct 5, 2013 at 10:00 AM, praveen_recker . <
> > > > praveen_recker () sify com> wrote:
> > > > are u able to ping from 172.20.54.211  to 172.20.54.213 and viceversa
> > > > once rsyslog configuration is done restart rsyslog service
> > > > on 172.20.54.213 run netstat -anu and check if 514/UDP is up
> > > > on snort machine and rsyslog server machine start Wireshark with a
> > > > filter "udp.port==514" and check for alerts
> > > >
> > > > Let me know the output of above steps
> > > >
> > > > Best Regards,
> > > > Praveen Darshanam
> > > >
> > > >
> > > >
> > > > On Fri, Oct 4, 2013 at 1:50 PM, Mayur Patil <ram.nath241089 () gmail com>wrote:
> > > > Hi,
> > > >
> > > >     I tried your all steps:
> > > >
> > > >     1.  I have disabled firewalls on all systems.
> > > >
> > > >     2.  I am also able to send message through *nc *and* telnet*.
> > > >
> > > >     In My Opinion, syslog is working fine. As even if I log messages on
> > > > client, they export to rSyslog server as per configuration.
> > > >
> > > >     For ex, my client(snort machine) is 172.20.54.211  and server is
> > > > 172.20.54.213 (rSyslog server)
> > > >
> > > >     If I send some message to 172.20.54.211, it will appear in syslog
> > > > of rSyslog server.
> > > >
> > > >     3. I have also added line to /etc/rsyslog.conf
> > > >
> > > >        *  *.*                                                     @
> > > > 172.20.54.213:514*
> > > >
> > > >      still not getting alerts in syslog of remote log server.
> > > >
> > > >     The thing I noticed:
> > > >
> > > >     When I restart snort from command line, I am *not seeing message *"unrecognized
> > > > syslog facility/priority: host=172.20.54.213:514,"
> > > >
> > > > *    in server syslog.*
> > > >
> > > >     If I run snort in NIDS mode, it gives error in the same snort
> > > > console, "unrecognized syslog facility/priority: host=172.20.54.213:514
> > > > ,"
> > > >
> > > >     Now what are the next steps please help ??
> > > >
> > > >     I am attaching snort and rsyslog conf files.
> > > >
> > > >     Seeking for the guidance,
> > > >
> > > >     Thanks !!
> > > >
> > > > On Fri, Sep 6, 2013 at 9:13 PM, praveen_recker . <
> > > > praveen_recker () sify com> wrote:
> > > > Hi Mayur,
> > > >
> > > > On Snort(172.20.54.211) setup add
> > > >
> > > > Modify syslog configuration file
> > > >                  /etc/rsyslog.conf
> > > > by adding line
> > > > *.*                                                     @172.20.54.213
> > > > :514
> > > >
> > > > I am not sure what is the use of "172.20.54.212 - other client".
> > > > Your Snort (172.20.54.211) setup will act as client and machine with
> > > > syslog acts as Server(172.20.54.213).
> > > >
> > > > Best Regards,
> > > > Praveen Darshanam
> > > >
> > > >
> > > > On Fri, Sep 6, 2013 at 12:33 PM, Mayur Patil <ram.nath241089 () gmail com>wrote:
> > > > Hi Pravin,
> > > >
> > > >   I am stuck on this issue. Please help !!
> > > >
> > > >   I am getting snort.log files on remote server when I restart snort.
> > > >
> > > >   but unable to get "alert" files log which is the utmost important part
> > > >
> > > >   172.20.54.211 -  snort machine
> > > >
> > > >   172.20.54.213- server machine
------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!