[Snort-users] Snort not logging....

Mike Koponick mike at ...7385...
Sun Jan 5 09:25:07 EST 2003


Andrew,

Thanks for the advice... your suggestion seems to be working just fine.

Mike

-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net]On Behalf Of Andrew R.
Baker
Sent: Saturday, January 04, 2003 12:17 PM
To: Mike Koponick
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Snort not logging....


Mike Koponick wrote:
> Hello,
>
> I know this has been discussed, and discussed... but I'm a little lost.
>
> I have SNORT configured to log to /var/log/snort/snort.log, however,
> everything goes to var/log/messages instead. I would rather keep the Snort
> logs seperate for parsing purposes.
>
> I'm running RH 8.0 and Snort 1.9.
>
> Here is a glimps into my config:
>
>
> In my snort.conf file I have:
> # alert_syslog: log alerts to syslog
> # ----------------------------------
> # Use one or more syslog facilities as arguments
> #
> output alert_syslog: LOG_AUTH LOG_ALERT

Well, here you are telling Snort that all alerts should get logged via
your systems syslog mechanism.



> Here is my startup script:
> INTERFACE=eth1
> CONFIG=/etc/snort/snort.conf
> # See how we were called.
> case "$1" in
>   start)
>         echo -n "Starting snort: "
>         ifconfig $INTERFACE promisc
>         daemon /usr/local/bin/snort -U -o -z -i $INTERFACE -d -D -c
> $CONFIG -l /var/log/snort/snort.log

And here you are telling Snort to use the directory
"/var/log/snort/snort.log" for any *files* it creates for alerts and
packet logs.


So, you need to either change Snort to use a different output mechanism
(such as alert_fast or alert_full) or edit /etc/syslog.conf to direct
syslog notices to the AUTH facility with the ALERT priority to a file
other than messages (which may also cause *other* programs to send
message there).  From what little you have said about what you want, I
would suggest doing the following:

1) Comment out the "output alert_syslog" line in snort.conf
2) Add this line to snort.conf:

     output alert_fast: snort.log

3) Change the argument to -l in the startup script to "/var/log/snort"
4) Make sure the directory /var/log/snort exists.

-A



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users





More information about the Snort-users mailing list