Re: Snort3, syslog, and some additional questions

The logs are written locally. A quick glance at alert_syslog.cc suggests you may need rsyslogd (or something similar) running to have them forwarded elsewhere.


Albert Lewis
ENGINEER.SOFTWARE ENGINEERING
Cisco Systems Inc.
Email: [email protected]<mailto:[email protected]>



From: Snort-users <[email protected]> on behalf of James Lay <[email protected]>
Reply-To: James Lay <[email protected]>
Date: Monday, January 17, 2022 at 10:47 AM
To: Snort <[email protected]>
Subject: [Snort-users] Snort3, syslog, and some additional questions

So....after about 20 minutes of searching, I'm no closer to discovering where exactly to specify the syslog server.  Some links I've stumbled on:

https://github.com/snort3/snort3/issues/216

and from:
https://www.snort.org/snort3

the entire bit about alert.syslog:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
alert_syslog
Help: output event to syslog

Type: logger

Usage: global

Configuration:

enum alert_syslog.facility = auth: part of priority applied to each message { auth | authpriv | daemon | user | local0 | local1 | local2 | local3 | local4 | local5 | local6 | local7 }
enum alert_syslog.level = info: part of priority applied to each message { emerg | alert | crit | err | warning | notice | info | debug }
multi alert_syslog.options: used to open the syslog connection { cons | ndelay | perror | pid }
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

No where does this specify how to specify the host.

So my questions:
Why are there NO examples of usage in the reference?
Where do I specify the server?

Thank you.

James

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette