RE: snort and syslog

[Shriman Gurung <sg () dataconnection com>]

You have a small error in your syslog.conf file.  If you have 
LOG_AUTH (say) in snort.conf then snort will use the syslog
facility of auth to log messages.  So you would expect to
see something like

auth.*          @loghost

in your syslog.conf file.  The * will catch all 'levels'
of message, eg debug, info, etc.  You can pick and choose
by replacing the * with a level, eg

auth.info               /var/log/snort.info

hth

shriman
--speaking for myself not my employer--

-----Original Message-----
From: Douglas F. Elznic [mailto:dfe () anize org]
Sent: 23 July 2001 03:13
To: snort-users () lists sourceforge net
Subject: [Snort-users] snort and syslog

[snip]

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users