Syslogging question

["Steve" <snort () dawson family name>]

Hi,

 

New to the list, new to Linux, new to Snort, but trying hard!

 

I have installed Smoothwall Express V2, and I'm having fun setting things up
and learning about all these things. But I'm stumped on one thing. I have
Kiwi Syslog Daemon running on a w2k3 box receiving syslog messages from
Smoothwall and Linux. I've changed syslog.conf to accomplish this, adding:

 

*.*                     @192.168.0.60

 

at the end. Now all my Smoothwall logs are happily arriving at Kiwi. But I'd
like to get Snort messages there too. I've changed snort.conf to uncomment
the line:

 

output alert_syslog: LOG_AUTH LOG_ALERT

 

but don't see any Snort messages in syslog. What else do I need to do? I've
trawled the web and archives but found nothing definitive, only lots of
people asking similar questions. Sorry if this has been covered before.

 

While I'm here, there is one other syslog-related problem, although not with
Snort. After Smoothwall boot, it takes about 5 minutes for Kiwi to start
receiving anything from Smoothwall, even though Smoothwall in the meantime
logs messages.

 

I have asked these questions on the Smoothwall list, but have received no
answers, so hoping someone here can help. Cheers.

 

Steve