sending snoopy log to prewikka

Hello,

 

I'm figuring out how I can send the log of snoopylogger (logs to syslog)
to my prelude manager server so it will show up un prewikka. I think
this can be done with prelude-lml but I'm not sure how I can achieve
this. I tried some stuff, this is what I came up with:

 

Prelude-lml.conf

[format=syslog]

time-format = "%b %d %H:%M:%S"

prefix-regex = "^(?P<timestamp>.{15}) (?P<hostname>\S+)
(?:(?P<process>\S+?)(?:\[(?P<pid>[0-9]+)\])?: )?"

file = /var/log/secure

 

Snoopy logs in /var/log/secure by syslog.

 

My guess is I need to build some pcre rules for the prelude-lml plugin
but I'm not sure. Somebody can point me in the right direction of maybe
have experience with getting snoopylogger logs in prewikka?

 

Kind Regards,

 

Niek Timmers

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user