[Snort-users] Syslog Help

Joel Esler jesler at ...1935...
Mon Mar 18 10:06:53 EDT 2013


On Mar 18, 2013, at 8:35 AM, Peter Bates <peter.bates at ...15381...> wrote:
> On 18/03/2013 12:20, Kevin Ross wrote:
>> I usually use unified 2 to barnyard which sends logs into mysql. Now I have
>> the need to send Syslog into another log collector. I haven't used syslog
>> for snort output in a while but I have never had these issues before.
> 
> We're sending syslog from Barnyard2 rather than Snort directly, with:
> 
> output alert_syslog: LOG_LOCAL1
> 
> - - i.e. local1 as the facility.
> 
> I think we went this way after seeing weird results
> from using the syslog output plugin directly in Snort itself.

I think the code that barnyard2 is using for their syslog output is a copy of the Snort syslog output.  I'm not sure if improvements have been made to this code, but I'd hope so.

That being said, and I guess it bears repeating for the hundreds of new people on the list since I last said it, Snort should output in unified2 and then barnyard2 should handle the output logging from there.

--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130318/6c1beb54/attachment.html>


More information about the Snort-users mailing list