[Snort-users] Problems logging to syslog and mysql simultaneously

Don Don at ...5881...
Wed Jun 26 09:38:08 EDT 2002


RE: [Snort-users] Problems logging to syslog and mysql simultaneouslyit
seems the only person it works for around here is M Steele.

Don

  -----Original Message-----
  From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net]On Behalf Of LaRose, Dallas
  Sent: Wednesday, June 26, 2002 8:17 AM
  To: snort-users at lists.sourceforge.net
  Subject: RE: [Snort-users] Problems logging to syslog and mysql
simultaneously


  Has anyone found any additional information on this problem?  Is anyone
else experiencing this?

  TIA,
  Dallas

  -----Original Message-----
  From: LaRose, Dallas [mailto:dlpassport at ...6137...]
  Sent: Thursday, June 20, 2002 11:33 AM
  To: 'Michael Steele'
  Cc: snort-users at lists.sourceforge.net
  Subject: RE: [Snort-users] Problems logging to syslog and mysql simultaneo
usly



  Michael,

  Please see my notes below.  Were you able to reproduce the problem?

  Thanks,
  Dallas



  -----Original Message-----
  From: Michael Steele [mailto:michaels at ...155...]
  Sent: Thursday, June 20, 2002 9:25 AM
  To: dlpassport at ...6137...
  Subject: RE: [Snort-users] Problems logging to syslog and mysql
simultaneously



  DL,

  We are working on this problem.

  1. You can log to local Syslog?
  *** Only when using -s ***

  Using what method?

  1. output alert_syslog: LOG_AUTH LOG_ALERT
     output alert_full
   *** This doesn't log at all ***

  2. -s xxx.xxx.xxx.xxx:xxx
  *** This works properly ***

  3. Item 2 is local or remote?
  *** When using a -s, this works locally and remotely ***

  -Michael
  --
   Michael Steele | System Engineer / Support Technician
mailto:michaels at ...155...
   Silicon Defense: IDS solutions - http://www.silicondefense.com
   Snort: Open Source Network IDS - http://www.snort.org




  -----Original Message-----
  From: snort-users-admin at lists.sourceforge.net
  [mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of
dlpassport at ...6137...
  Sent: Thursday, June 20, 2002 5:25 AM
  To: snort-users at lists.sourceforge.net
  Subject: RE: [Snort-users] Problems logging to syslog and mysql
simultaneously

  Per our discussion yesterday, I am still having similar problems.  I am
unable to log to a local syslog without a command line switch.

  The -s x.x.x.x:xxx does work on Win32... but when using this option, all
other outputs are disabled.  Even with the

  output alert_syslog: LOG_AUTH LOG_ALERT

  output alert_full

  in my snort.conf, I am still experiencing the problem.  Does anyone have a
snort.conf that works?  Is there any "order of operations" or sequence with
the conf options?

  Also.. Michael... the Kiwi syslog server does RegExp checking and can run
an executable based on a RegExp match.  Have this trip a batch file which
calls Blat to send an e-mail.  This should work well for you.  Not as clean
as swatch, but it works.

  Thanks... DL

  -----Original Message-----

  From: Steven Williams [mailto:Steven.Williams at ...4864...]

  Sent: Wednesday, June 19, 2002 9:33 PM

  To: 'snort-users at lists.sourceforge.net'

  Subject: [Snort-users] RE: Problems logging to syslog and mysql
simultaneously






  I've had exactly the same problem with my setup.

  I can get snort to log to either Syslog locally or remotely, but not at
the same time as logging to the remote database.

  I've tried both the -s options on the command line, and also Michaels
suggestions within snort.conf, but it will only let me have one or the
other, and the -s option does turn on or off the syslog option. Changing any
parameters with snort.conf don't seem to make any difference.

  This is with snort 1.8.7-MySQL-Win32 Build 121 on W2K Server, using Kiwi
Syslog Server Ver 6.4.9. I am logging remotely to another W2K server also
running the same version of Kiwi and MySql 3.23.40.

  Steve








  ---

  This email and any files transmitted with it are solely intended for the
use of the

  addressee(s) and may contain information that is confidential and
privileged. If you receive this email in error, please advise us by return
email immediately. Please also disregard the contents of the email, delete
it and destroy any copies immediately. Computershare Limited and its
subsidiaries do not accept liability for the views expressed in the email or
for the consequences of any computer viruses that may be transmitted with
this email

  This email is also subject to copyright. No part of it should be
reproduced, adapted or

  transmitted without the written consent of the copyright owner.






  -------------------------------------------------------

  Bringing you mounds of caffeinated joy

  >>> http://thinkgeek.com/sf <<<

  _______________________________________________

  Snort-users mailing list

  Snort-users at lists.sourceforge.net

  Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users

  Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users





  -------------------------------------------------------
                     Bringing you mounds of caffeinated joy
                     >>>     http://thinkgeek.com/sf    <<<

  _______________________________________________
  Snort-users mailing list
  Snort-users at lists.sourceforge.net
  Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
  Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users





  -------------------------------------------------------
                     Bringing you mounds of caffeinated joy
                     >>>     http://thinkgeek.com/sf    <<<

  _______________________________________________
  Snort-users mailing list
  Snort-users at lists.sourceforge.net
  Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
  Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users



  -------------------------------------------------------
  This sf.net email is sponsored by: Jabber Inc.
  Don't miss the IM event of the season | Special offer for OSDN members!
  JabConf 2002, Aug. 20-22, Keystone, CO http://www.jabberconf.com/osdn
_______________________________________________
  Snort-users mailing list
  Snort-users at lists.sourceforge.net
  Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
  Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20020626/82e1b40b/attachment.html>


More information about the Snort-users mailing list