Re: Snort3, syslog, and some additional questions

I went into the source code to see if the option was there and not missing in the help section somehow.

The options listed in the snort documents are the ones available.


Albert Lewis
ENGINEER.SOFTWARE ENGINEERING
Cisco Systems Inc.
Email: [email protected]<mailto:[email protected]>



From: James Lay <[email protected]>
Reply-To: James Lay <[email protected]>
Date: Monday, January 17, 2022 at 12:46 PM
To: "Al Lewis (allewi)" <[email protected]>, Snort <[email protected]>
Subject: Re: [Snort-users] Snort3, syslog, and some additional questions

Thanks for the response Al.  This brings up a couple points:

This is, in fact, a downgrade compared to snort 2.  I've never understood new software version that remove functionality from the older version.

The fact that you had to go to the source code to get the info......why?  Why isn't this information IN the snort docs?  Does Cisco really expect users to have to go pouring into the source just got get an answer?


So....after that, please consider this a feature request...to put BACK the ability of being able to have snort3 natively syslog.  Thanks Al!

James

On Mon, 2022-01-17 at 17:16 +0000, Al Lewis (allewi) wrote:
The logs are written locally. A quick glance at alert_syslog.cc suggests you may need rsyslogd (or something similar) running to have them forwarded elsewhere.


Albert Lewis
ENGINEER.SOFTWARE ENGINEERING
Cisco Systems Inc.
Email: [email protected]<mailto:[email protected]>



From: Snort-users <[email protected]> on behalf of James Lay <[email protected]>
Reply-To: James Lay <[email protected]>
Date: Monday, January 17, 2022 at 10:47 AM
To: Snort <[email protected]>
Subject: [Snort-users] Snort3, syslog, and some additional questions

So....after about 20 minutes of searching, I'm no closer to discovering where exactly to specify the syslog server.  Some links I've stumbled on:

https://github.com/snort3/snort3/issues/216

and from:
https://www.snort.org/snort3

the entire bit about alert.syslog:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
alert_syslog
Help: output event to syslog

Type: logger

Usage: global

Configuration:

enum alert_syslog.facility = auth: part of priority applied to each message { auth | authpriv | daemon | user | local0 | local1 | local2 | local3 | local4 | local5 | local6 | local7 }
enum alert_syslog.level = info: part of priority applied to each message { emerg | alert | crit | err | warning | notice | info | debug }
multi alert_syslog.options: used to open the syslog connection { cons | ndelay | perror | pid }
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

No where does this specify how to specify the host.

So my questions:
Why are there NO examples of usage in the reference?
Where do I specify the server?

Thank you.

James

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette