[Snort-users] logging to syslog:messages
erek at ...577...
Mon Sep 24 14:04:02 EDT 2001
On Mon, 24 Sep 2001, Travis Farmer wrote:
> What do i have to do to get snort to log to the messages syslog file?
> I hve the following line in the config file;
> output alert_syslog: messages
Erf. Not quite right....
> I would like to be able to log so that the attacked_snort.pl script (from
> Brian <bmc at ...950...>) will parse the portscans.
> What else needs to be setup in order to do this?
# alert_syslog: log alerts to syslog
# Use one or more syslog facilities as arguments
output alert_syslog: LOG_AUTH LOG_ALERT
Where L)G_AUTH and LOG_ALERT are the message facility and message
priority/severity. Have a look at 'man syslog' and you should see something
Possible values of severity level include:
LOG_ALERT A condition that should be corrected immediately,
such as a corrupted system database.
The facility indicates the application or system component
generating the message. Possible facility values include:
LOG_AUTH The authorization system: login(1), su(1M),
If you want it go to the same place as messages, then check /etc/syslog.conf
for the facility and priority that messages has. For example:
Or you could be sneaky and put it as LOG_LOCALx and have all log.localx
messages goto one file. Cleaner parsing that way. (LocalX is defined in the
syslog man pages... :)
Good luck and I hope this helps!
More information about the Snort-users