Re: Snort, Mudpit, Unified logs and me...

[Ben Nelson <lists () venom600 org>]

My setup == :
- Snort logging to unified format on local disk
- Stunnel (www.stunnel.org) listening on localhost:3306 and forwarding 
connections to my remote data collector
- mudpit configured to read (and rotate) unified logs on local disk and 
insert into mysql database at localhost:3306 (which is actually my 
remote data collector)
- a cron job that periodically cleans up unified log files on the sensor 
disk

Works pretty well for me, with multiple remote sensors (sensors are many 
thousands of miles apart)

--Ben

Russell Packer wrote:
> Hi all,
>
> I'm trying to set up what I think is "a normal" system pair:
>
> System 1: The Snort machine (Devil)
> System 2: The log processing / alerting machine (Slackware 9.x)
>
> Having done lots and lots of reading, it seems that the unified (binary) output is "best" (as non-unified seems to lead 
> to problems).
>
> [As a side note, I did look at FLoP but patching snort is not an option due to the fact that I'm using a pre-built 
> live-CD for system 1]
>
> Now, it seems that I have two options on system 2 - either Barnyard or Mudpit. Seeing as I can't get Barnyard to configure (tried 
> MySQL 3.23, 4.017, my_connect, mysql_real_connect and all those other "fixes" to no avail), I'm forced to use Mudpit.
>
> As I'm sure anyone else using mudpit is aware, there isn't a whole lot of documentation ;)
>
> I'm currently getting my head round the Mudpit configuration, more specifically the Spool section. The section starts 
> like this:
>
> # Spool configurarion. One or more spools should be configured.
> # Spool definition contains the absolute path to a spool directory
> # (that is, the directory containing Snort's log/alert file pair)
> # and parameters for the spool processor.
>
> Seems fair enough. In the Snort confiuration file, there is this information:
>
> # Two arguments are supported.
> #    filename - base filename to write to (current time_t is appended)
> #    limit    - maximum size of spool file in MB (default: 128)
> #
> # output alert_unified: filename snort.alert, limit 128
> # output log_unified: filename snort.log, limit 128
>
> Hm. This raises 2 questions:
>
> 1.) How does one specifiy that these two files should actually be sent on a remote machine? In the MySQL example, it is 
> obvious that you can specify a host, but mudput requires the files :/
>
> 2.) As these log files need to reside on a remote system, how would the limit work?
>
>
> I may, of course, also be going along the wrong track, so any pointers much appreciated!
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: IBM Linux Tutorials.
> Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
> Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
> Click now! http://ads.osdn.com/?ad_id78&alloc_id371&opÌk
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list


-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id78&alloc_id371&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users