Snort3, syslog, and some additional questions
James Lay <[email protected]>
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <095671f03744884acca5abc53b21cbba661cab64.camel@slave-tothe-box.net> |
So....after about 20 minutes of searching, I'm no closer to discovering
where exactly to specify the syslog server. Some links I've stumbled
on:
https://github.com/snort3/snort3/issues/216
and from:
https://www.snort.org/snort3
the entire bit about alert.syslog:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
alert_syslog
Help: output event to syslog
Type: logger
Usage: global
Configuration:
enum alert_syslog.facility = auth: part of priority applied to each
message { auth | authpriv | daemon | user | local0 | local1 | local2 |
local3 | local4 | local5 | local6 | local7 }
enum alert_syslog.level = info: part of priority applied to each
message { emerg | alert | crit | err | warning | notice | info | debug
}
multi alert_syslog.options: used to open the syslog connection { cons |
ndelay | perror | pid }
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
No where does this specify how to specify the host.
So my questions:
Why are there NO examples of usage in the reference?
Where do I specify the server?
Thank you.
James
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users
To unsubscribe, send an email to:
[email protected]
Please visit http://blog.snort.org to stay current on all the latest Snort news!
Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette