Jason K. Boykin
jboykin at ...9552...
Wed Jul 2 11:30:21 EDT 2003
/usr/local/bin/snort -u snort -o -b -l /var/log/snort -d -D -i $INTERFACE -c
Although Im logging it to localhost.
Under alert_syslog: Ive got
output alert_fast: alert
You could specify full here
Under database: Im using
output database: alert, postgresql, dbname=snort user=snort password=xxx
try changing host to the ip your wanting to log to and the rest of the info
needs to be correct.
Here is a snippet from pg_hba.conf that you will need to modify to allow your
snort machine to log to the database machine but it sounds like you already
# Put your actual configuration here
# This default configuration allows any local user to connect as any
# PostgreSQL username, over either UNIX domain sockets or IP:
local all trust
host all 127.0.0.1 255.255.255.255 trust
Hope this helps!
On Wednesday 02 July 2003 12:36 pm, Bryan Irvine wrote:
> I'm trying to do remote logging with a postgresql db.
> I've configured postgres, and can log in remotely, all the tables ahve
> been created (via the create_postgresql script), I can log in run sql
> commands but can't figure out how to get snort to log to it. I've tried
> output database: alert, mysql, user=username dbname=snort host=hostname
> output database: log, mysql, user=username dbname=snort host=hostname
> output database: alert, mysql, user=username password=password \
> dbname=snort host=hostname
> The snort command I'm running is
> snort -i xl1 -A FULL -c /usr/local/share/snort/snort.conf -l
> I've tried without the -l option (thinking maybe it can't log to a
> directory and db at the same time) but then I get an error that
> /var/snortsomething doesn't exist.
> Any ideas? This seems like I'm so close...
More information about the Snort-users