RE: Remote Syslog

["Michael Steele" <michaels () silicondefense com>]

John,

In your etc/syslog.conf file use the @ symbol to direct the syslog to a
remote machine.

I believe the line to add in syslog.conf is:

LOG_LOCAL1              @x.x.x.x

This will send all alerts to your remote syslog. It must match your
output alert line in snort.conf

output alert_syslog: LOG_LOCAL1 LOG_ALERT

Your remote syslog server will need to have the appropriate settings
installed in your syslog.conf.

LOG_LOCAL1              /var/log/snort

Michael Steele | Support Technician
mailto:michaels () silicondefense com
Silicon Defense: IDS solutions - http://www.silicondefense.com
Snort: Open Source Network IDS - http://www.snort.org


-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of John
Maestrale
Sent: Thursday, May 09, 2002 10:37 AM
To: Snort-Users (E-mail)
Subject: [Snort-users] Remote Syslog

Does anyone now how to report alerts to a remote syslog machine.

Thanks,
John 



_______________________________________________________________

Have big pipes? SourceForge.net is looking for download mirrors. We
supply
the hardware. You get the recognition. Email Us:
bandwidth () sourceforge net
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users




_______________________________________________________________

Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: bandwidth () sourceforge net
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users