RE: [Snort-users] Syslogging question

Steve,

Not sure what all you've tried, but consider...
1. use the snort.conf to send the alerts to the linux syslog facility,
2. configure the linux syslog facility to "handle" the incoming snort alerts
3. restart linux syslogd (required to reread config changes)
4. verify the linux syslogd is actually writing to a /var/log... file
5. when that is working, then add a linux syslog.conf statement (leave snort.conf
alone) to forward these incoming messages to a distant machine (kiwi syslog).
The syntax is something like "kern.crit @kiwi.machine.com" and can be
found in 'man syslog.conf'.
6. when all of that is working, then try messing around with forwarding syslog
messages directly from snort to kiwi, bypassing linux syslogd.

I use snort on win32 with syslog a lot (for low volume sensors), but not
on linux systems. I faintly recall (from a long time ago) that snort on linux
writes the syslog messages via the linux OS calls (not the ip stack), and
likely requires you config to first write the alerts to the linux syslog.

All unix systems that I'm familiar with have a syslog config option to forward
syslog messages to a distant machine "after" the unix syslog function receives
the message. Remember any changes to /etc/syslog.conf requires a restart of
the linux syslogd.

Rich

------------------------

> Tried it just then, but still no messages in syslog...
>
> Steve
>
>
> > -----Original Message-----
> > From: Matt [mailto:matt@bfinity.kicks-ass.net]
> > Sent: Tuesday, 24 August 2004 1:18 PM
> > To: Steve
> > Subject: Re: [Snort-users] Syslogging question
> >
> >
> > Sorry I Didnt read,
> > :)
> > just for curiosity sake did you try it?
> >
> >
> > Steve wrote:
> >
> > >Matt,
> > >
> > >As I read it, the host= format only applies to the win32 version, not the
> > >Unix version...
> > >
> > >Steve
> > >
> > >
> > >
> > >
> > >>-----Original Message-----
> > >>From: Matt [mailto:matt@bfinity.kicks-ass.net]
> > >>Sent: Monday, 23 August 2004 3:14 PM
> > >>To: Steve
> > >>Cc: snort-users@lists.sourceforge.net
> > >>Subject: Re: [Snort-users] Syslogging question
> > >>
> > >>################################################ ####################
> > >># Step #3: Configure output plugins
> > >>#
> > >># Uncomment and configure the output plugins you decide to use. General
> > >># configuration for output plugins is of the form:
> > >>#
> > >># output <name_of_plugin>: <configuration_options>
> > >>#
> > >># alert_syslog: log alerts to syslog
> > >># ----------------------------------
> > >># Use one or more syslog facilities as arguments. Win32 can also
> > >>optionally
> > >># specify a particular hostname/port. Under Win32, the default hostname
> > is
> > >># '127.0.0.1', and the default port is 514.
> > >>#
> > >># [Unix flavours should use this format...]
> > >># output alert_syslog: LOG_AUTH LOG_ALERT
> > >>#
> > >># [Win32 can use any of these formats...]
> > >># output alert_syslog: LOG_AUTH LOG_ALERT
> > >># output alert_syslog: host=localhost, LOG_AUTH LOG_ALERT
> > >># output alert_syslog: host=hostname:port, LOG_AUTH LOG_ALERT
> > >>
> > >>Try this:
> > >>
> > >>output alert_syslog: host=hostname:port, LOG_AUTH LOG_ALERT
> > >>
> > >>HTH
> > >>Matt
> > >>
> > >>
> > >>
> > >>Steve wrote:
> > >>
> > >>
> > >>
> > >>>Hi,
> > >>>
> > >>>New to the list, new to Linux, new to Snort, but trying hard!
> > >>>
> > >>>I have installed Smoothwall Express V2, and I'm having fun setting
> > >>>things up and learning about all these things. But I'm stumped on one
> > >>>thing. I have Kiwi Syslog Daemon running on a w2k3 box receiving
> > >>>syslog messages from Smoothwall and Linux. I've changed syslog.conf to
> > >>>accomplish this, adding:
> > >>>
> > >>>*.* @192.168.0.60
> > >>>
> > >>>at the end. Now all my Smoothwall logs are happily arriving at Kiwi.
> > >>>But I'd like to get Snort messages there too. I've changed snort.conf
> > >>>to uncomment the line:
> > >>>
> > >>>output alert_syslog: LOG_AUTH LOG_ALERT
> > >>>
> > >>>but don't see any Snort messages in syslog. What else do I need to do?
> > >>>I've trawled the web and archives but found nothing definitive, only
> > >>>lots of people asking similar questions. Sorry if this has been
> > >>>covered before.
> > >>>
> > >>>While I'm here, there is one other syslog-related problem, although
> > >>>not with Snort. After Smoothwall boot, it takes about 5 minutes for
> > >>>Kiwi to start receiving anything from Smoothwall, even though
> > >>>Smoothwall in the meantime logs messages.
> > >>>
> > >>>I have asked these questions on the Smoothwall list, but have received
> > >>>no answers, so hoping someone here can help. Cheers.
> > >>>
> > >>>*Steve*
> > >>>
> > >>>
> > >>>
> > >
> > >
> > >
> > >
> > >-------------------------------------------------------
> > >SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
> > >100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
> > >Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
> > >http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
> > >_______________________________________________
> > >Snort-users mailing list
> > >Snort-users@lists.sourceforge.net
> > >Go to this URL to change user options or unsubscribe:
> > >https://lists.sourceforge.net/lists/...fo/snort-users
> > >Snort-users list archive:
> > >http://www.geocrawler.com/redir-sf.php3?list=ort-users
> > >
> > >
> > >
>
>
>
>
> -------------------------------------------------------
> SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
> 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
> Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
> http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/...fo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list

---------------End of Original Message-----------------




-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users