Snort mailing list archives
Re: change syslog messages
From: MMartin () jwpepper com
Date: Tue, 11 Mar 2014 13:14:29 -0400
Hey Luis, I'm new to snort myself so if I'm wrong I'm sure someone will correct me.. But in your Config file (*/etc/snort/snort.conf most likely) you should have a section for Logging. I believe you can specify the log file output format in the config file, and on the command line you can specify where to log by using the -l option. I believe if you specify an output FORMAT, you can also specify a pattern for which the log file will be named. For example, the line below is from MY config file, which will create a filename using the format "snort.u2".
From Config File:
output unified2: filename snort.u2, limit 128 *This will output in the Unified2 format, aka binary mode... Snort Command, like so: /usr/local/bin/snort -c /etc/snort/snort.conf -i eth0 -l /var/log/snort .....more options..... -b Since I chose to log in binary mode (aka Unified2 mode) I would include the "-b" option on the command line. So this will begin logging to a file in the directory /var/log/snort. And I think by default (*at least for me) it will log to a file that looks like: /var/log/snort/snort.u2.####### Where the "#######" symbols are actually numbers representing the timestamp for when snort was started. And I think if you DO NOT specify an option like the "-b" option for binary mode and you didn't have the line from above, under "From Config File:", it will log in plain text... I think? To a file that looks like: /var/log/snort/snort.log.####### Hope that helps! Thanks, Matt From: "Budinich Galvez, Luis Alberto" <BUDINIL () 3p mapfre com> To: "'snort-users () lists sourceforge net'" <snort-users () lists sourceforge net> Date: 03/11/2014 12:41 PM Subject: [Snort-users] change syslog messages Hello, snort users!!! I want to ask if would be possible to send all snort syslog-messages to another log file (not /var/log/messages). ¿ What do you think? Regards. Luis Budinich. ------------------------------------------------------------------------------ Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. Written by three acclaimed leaders in the field, this first edition is now available. Download your free book today! http://p.sf.net/sfu/13534_NeoTech _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------ Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. Written by three acclaimed leaders in the field, this first edition is now available. Download your free book today! http://p.sf.net/sfu/13534_NeoTech
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- change syslog messages Budinich Galvez, Luis Alberto (Mar 11)
- Re: change syslog messages MMartin (Mar 11)
- Re: change syslog messages MMartin (Mar 11)
- Re: change syslog messages Budinich Galvez, Luis Alberto (Mar 12)
- Re: change syslog messages waldo kitty (Mar 11)