Snort mailing list archives
Re: logging to syslog:messages
From: Erek Adams <erek () theadamsfamily net>
Date: Mon, 24 Sep 2001 14:03:40 -0700 (PDT)
On Mon, 24 Sep 2001, Travis Farmer wrote:
What do i have to do to get snort to log to the messages syslog file? I hve the following line in the config file; ------------ output alert_syslog: messages ------------
Erf. Not quite right....
I would like to be able to log so that the attacked_snort.pl script (from Brian <bmc () snort org>) will parse the portscans. What else needs to be setup in order to do this?
# alert_syslog: log alerts to syslog # ---------------------------------- # Use one or more syslog facilities as arguments # output alert_syslog: LOG_AUTH LOG_ALERT Where L)G_AUTH and LOG_ALERT are the message facility and message priority/severity. Have a look at 'man syslog' and you should see something like: [...] Possible values of severity level include: [...] LOG_ALERT A condition that should be corrected immediately, such as a corrupted system database. [...] The facility indicates the application or system component generating the message. Possible facility values include: [...] LOG_AUTH The authorization system: login(1), su(1M), getty(1M). If you want it go to the same place as messages, then check /etc/syslog.conf for the facility and priority that messages has. For example: *.err;kern.debug;daemon.notice;mail.crit /var/adm/messages Or you could be sneaky and put it as LOG_LOCALx and have all log.localx messages goto one file. Cleaner parsing that way. (LocalX is defined in the syslog man pages... :) Good luck and I hope this helps! ----- Erek Adams Nifty-Type-Guy TheAdamsFamily.Net _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- logging to syslog:messages Travis Farmer (Sep 24)
- Re: logging to syslog:messages Erek Adams (Sep 24)