Snort fails to dump alerts to Solaris 8 Syslog

["Richard Pitkanen" <rpitkanen () open com>]

Greetings,

I've recently installed Snort on my Solaris 8 box, edited the snort.conf to
allow syslog logging, yet running this command gives me nothing in syslog;

"snort -s -A Fast -c /usr/local/snort-2.0.1/etc/snort.conf" 

root @ wolf : ~ 16:33:32 --> snort -s -A fast -c
/usr/local/snort-2.0.1/etc/snort.conf
 
Running in IDS mode
Log directory = /var/log/snort

Initializing Network Interface eri0

        --== Initializing Snort ==--
Initializing Output Plugins!
Decoding Ethernet on interface eri0
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file /usr/local/snort-2.0.1/etc/snort.conf

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
No arguments to frag2 directive, setting defaults to:
    Fragment timeout: 60 seconds
    Fragment memory cap: 4194304 bytes
    Fragment min_ttl:   0
    Fragment ttl_limit: 5
    Fragment Problems: 0
    Self preservation threshold: 500
    Self preservation period: 90
    Suspend threshold: 1000
    Suspend period: 30
Stream4 config:
    Stateful inspection: ACTIVE
    Session statistics: INACTIVE
    Session timeout: 30 seconds
    Session memory cap: 8388608 bytes
    State alerts: INACTIVE
    Evasion alerts: INACTIVE
    Scan alerts: ACTIVE
    Log Flushed Streams: INACTIVE
    MinTTL: 1
    TTL Limit: 5
    Async Link: 0
    State Protection: 0
    Self preservation threshold: 50
    Self preservation period: 90
    Suspend threshold: 200
    Suspend period: 30
Stream4_reassemble config:
    Server reassembly: INACTIVE
    Client reassembly: ACTIVE
    Reassembler alerts: ACTIVE
    Ports: 21 23 25 53 80 110 111 143 513 1433 
    Emergency Ports: 21 23 25 53 80 110 111 143 513 1433 
http_decode arguments:
    Unicode decoding
    IIS alternate Unicode decoding
    IIS double encoding vuln
    Flip backslash to slash
    Include additional whitespace separators
    Ports to decode http on: 80 
rpc_decode arguments:
    Ports to decode RPC on: 111 32771 
    alert_fragments: INACTIVE
    alert_large_fragments: ACTIVE
    alert_incomplete: ACTIVE
    alert_multiple_requests: ACTIVE
telnet_decode arguments:
    Ports to decode telnet on: 21 23 25 119 
1454 Snort rules read...
1454 Option Chains linked into 146 Chain Headers
0 Dynamic rules
+++++++++++++++++++++++++++++++++++++++++++++++++++

Rule application order: ->activation->dynamic->alert->pass->log

        --== Initialization Complete ==--

Here's the edit in my snort.conf;

####################################################################
# Step #3: Configure output plugins
#
# Uncomment and configure the output plugins you decide to use. # General
configuration for output plugins is of the form: 
# 
# output <name_of_plugin>: <configuration_options> 
# 
# alert_syslog: log alerts to syslog 
# ----------------------------------
# Use one or more syslog facilities as arguments.  Win32 can also 
# optionally specify a particular hostname/port.  Under Win32, the 
# default hostname is '127.0.0.1', and the default port is 514. 
# 
# [Unix flavours should use this format...] 
output alert_syslog: LOG_AUTH LOG_ALERT 
# 
# [Win32 can use any of these formats...] 
# output alert_syslog: LOG_AUTH LOG_ALERT 
# output alert_syslog: host=hostname, LOG_AUTH LOG_ALERT 
# output alert_syslog: host=hostname:port, LOG_AUTH LOG_ALERT

What else needs to be configured? Syslog is processing other events just
fine. Does syslog.conf need some modifications to work with snort?

Any help, ideas, or "go read this FAQ" greatly appreciated, thanks.

Richard Pitkanen
Sr. Customer Support Engineer
Open Service
http://www.open.com




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users