Re: Snort3, syslog, and some additional questions

James,

I've responded to that. You haven't answered my questions.

Russ
________________________________
From: James Lay <[email protected]>
Sent: Wednesday, January 19, 2022 1:50 PM
To: Russ Combs (rucombs) <[email protected]>
Cc: Snort <[email protected]>; Al Lewis (allewi) <[email protected]>
Subject: Re: [Snort-users] Snort3, syslog, and some additional questions

Wow...ok I guess I didn't specify this well at all.  To sum it up:

Snort 3 on linux...WHERE exactly do you specify the remote IP to send
snort alert output to?

Here's the only info I have:

10.6. alert_syslog
--------------
Help: output event to syslog
Type: logger
Usage: global
Configuration:

   * enum alert_syslog.facility = auth: part of priority applied to
     each message { auth | authpriv | daemon | user | local0 | local1
     | local2 | local3 | local4 | local5 | local6 | local7 }
   * enum alert_syslog.level = info: part of priority applied to each
     message { emerg | alert | crit | err | warning | notice | info |
     debug }
   * multi alert_syslog.options: used to open the syslog connection {
     cons | ndelay | perror | pid }

There...that should do it..thank you :)

James

On 2022-01-19 11:23, Russ Combs (rucombs) wrote:
> James,
>
>  I'm not sure we are talking about the same thing. I'm saying the
> difference in functionality is that Snort 2 emits a warning and Snort
> 3 emits an error. That difference is intentional and will remain.
>
>  To be clear, you are saying "output alert_syslog: host" is working
> for Snort 2 on Linux? Are you not seeing the warning on Linux like the
> one shown below? Does it still work if you remove the host
> specification?
>
>  Russ
>
> -------------------------
>
> FROM: James Lay <[email protected]>
> SENT: Wednesday, January 19, 2022 10:31 AM
> TO: Russ Combs (rucombs) <[email protected]>
> CC: Snort <[email protected]>; Al Lewis (allewi)
> <[email protected]>
> SUBJECT: Re: [Snort-users] Snort3, syslog, and some additional
> questions
>
> This is on linux....no issues with snort 2, but I'd like to not have
> to
> futz with my rsyslog/syslog-ng configs just for snort.  The snort 2
> functionality should be the same in snort 3.  In my opinion.
>
> James
>
> On 2022-01-18 07:58, Russ Combs (rucombs) wrote:
>> James,
>>
>> output alert_syslog: host is Snort 2 feature for Windows only. Snort
> 3
>> does not support Windows at present.
>>
>> If you have that in your non-Windows Snort 2 config, you should be
>> getting a warning like this in your startup output:
>>
>>      WARNING: etc/snort.conf (538) => Unrecognized syslog
>> facility/priority: host=10.1.1.1:514,
>>
>>  Russ
>>
>> -------------------------
>>
>> FROM: Snort-users <[email protected]> on behalf of
>> Al Lewis (allewi) via Snort-users <[email protected]>
>> SENT: Monday, January 17, 2022 1:31 PM
>> TO: [email protected] <[email protected]>; Snort
>> <[email protected]>
>> SUBJECT: Re: [Snort-users] Snort3, syslog, and some additional
>> questions
>>
>> I went into the source code to see if the option was there and not
>> missing in the help section somehow.
>>
>> The options listed in the snort documents are the ones available.
>>
>> ALBERT LEWIS
>>
>> ENGINEER.SOFTWARE ENGINEERING
>>
>> Cisco Systems Inc.
>>
>> Email: [email protected]
>>
>> FROM: James Lay <[email protected]>
>> REPLY-TO: James Lay <[email protected]>
>> DATE: Monday, January 17, 2022 at 12:46 PM
>> TO: "Al Lewis (allewi)" <[email protected]>, Snort
>> <[email protected]>
>> SUBJECT: Re: [Snort-users] Snort3, syslog, and some additional
>> questions
>>
>> Thanks for the response Al.  This brings up a couple points:
>>
>> This is, in fact, a downgrade compared to snort 2.  I've never
>> understood new software version that remove functionality from the
>> older version.
>>
>> The fact that you had to go to the source code to get the
>> info......why?  Why isn't this information IN the snort docs?  Does
>> Cisco really expect users to have to go pouring into the source just
>> got get an answer?
>>
>> So....after that, please consider this a feature request...to put
> BACK
>> the ability of being able to have snort3 natively syslog.  Thanks
> Al!
>>
>> James
>>
>> On Mon, 2022-01-17 at 17:16 +0000, Al Lewis (allewi) wrote:
>>
>>> The logs are written locally. A quick glance at alert_syslog.cc
>>> suggests you may need rsyslogd (or something similar) running to
>>> have them forwarded elsewhere.
>>>
>>> ALBERT LEWIS
>>>
>>> ENGINEER.SOFTWARE ENGINEERING
>>>
>>> Cisco Systems Inc.
>>>
>>> Email: [email protected]
>>>
>>> FROM: Snort-users <[email protected]> on behalf
> of
>>> James Lay <[email protected]>
>>> REPLY-TO: James Lay <[email protected]>
>>> DATE: Monday, January 17, 2022 at 10:47 AM
>>> TO: Snort <[email protected]>
>>> SUBJECT: [Snort-users] Snort3, syslog, and some additional
> questions
>>>
>>>
>>> So....after about 20 minutes of searching, I'm no closer to
>>> discovering where exactly to specify the syslog server.  Some links
>>> I've stumbled on:
>>>
>>> https://github.com/snort3/snort3/issues/216
>>>
>>> and from:
>>>
>>> https://www.snort.org/snort3
>>>
>>> the entire bit about alert.syslog:
>>>
>>> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>>>
>>> alert_syslog
>>>
>>> Help: output event to syslog
>>>
>>> Type: logger
>>>
>>> Usage: global
>>>
>>> Configuration:
>>>
>>> enum alert_syslog.facility = auth: part of priority applied to each
>>> message { auth | authpriv | daemon | user | local0 | local1 |
> local2
>>> | local3 | local4 | local5 | local6 | local7 }
>>>
>>> enum alert_syslog.level = info: part of priority applied to each
>>> message { emerg | alert | crit | err | warning | notice | info |
>>> debug }
>>>
>>> multi alert_syslog.options: used to open the syslog connection {
>>> cons | ndelay | perror | pid }
>>>
>>> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>>>
>>> No where does this specify how to specify the host.
>>>
>>> So my questions:
>>>
>>> Why are there NO examples of usage in the reference?
>>>
>>> Where do I specify the server?
>>>
>>> Thank you.
>>>
>>> James

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette