Re: logging to syslog:messages

[Erek Adams <erek () theadamsfamily net>]

On Mon, 24 Sep 2001, Travis Farmer wrote:

> What do i have to do to get snort to log to the messages syslog file?
>
> I hve the following line in the config file;
> ------------
> output alert_syslog: messages
> ------------

Erf.  Not quite right....

> I would like to be able to log so that the attacked_snort.pl script (from
> Brian <bmc () snort org>) will parse the portscans.
>
> What else needs to be setup in order to do this?

# alert_syslog: log alerts to syslog
# ----------------------------------
# Use one or more syslog facilities as arguments
#
output alert_syslog: LOG_AUTH LOG_ALERT

Where L)G_AUTH and LOG_ALERT are the message facility and message
priority/severity.  Have a look at 'man syslog' and you should see something
like:

[...]
     Possible values of severity level include:
[...]
     LOG_ALERT A condition that should be corrected  immediately,
               such as a corrupted system database.
[...]

     The facility indicates the application or  system  component
     generating the message.  Possible facility values include:
[...]
     LOG_AUTH  The  authorization   system:   login(1),   su(1M),
               getty(1M).

If you want it go to the same place as messages, then check /etc/syslog.conf
for the facility and priority that messages has.  For example:

*.err;kern.debug;daemon.notice;mail.crit        /var/adm/messages

Or you could be sneaky and put it as LOG_LOCALx and have all log.localx
messages goto one file.  Cleaner parsing that way.  (LocalX is defined in the
syslog man pages...  :)

Good luck and I hope this helps!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users