Re: Snort3, syslog, and some additional questions

Thanks Patrick!

So.....per the snort 2 syslog option docs:

output alert_syslog: host=10.1.1.1:514, <facility> <priority> <options>

I can indeed specify which syslog server to go to.  This...this is what 
I'm asking for/about for snort 3.

Thanks again...and long time no chat, I have been good.  Busy....but 
good :)

James

On 2022-01-19 14:15, Patrick Mullen (pamullen) wrote:
> James,
> 
> How have you been?  I hope you are well.  It's been too long since
> we've chatted.
> 
> The way this is handled on Snort 3 (which is the way it's handled in
> Snort 2 on non-Windows devices) is the alerts are logged to the local
> syslog, and the local syslog would then be configured to send those
> alerts to a remote syslog server if that's what you want to do.  By
> doing it this way, it allows Snort to hand the information off to the
> local logging facility and get back to work doing detection while the
> OS can handle all of the network communications and the rest regarding
> the logs.  Make sense?
> 
> Let me know if you have any questions.  Glad to see you're out there
> kicking the tires!
> 
> Thanks,
> 
> ~Patrick
> 
> -------------------------
> 
> FROM: James Lay <[email protected]>
> SENT: Wednesday, January 19, 2022 2:39 PM
> TO: Russ Combs (rucombs) <[email protected]>
> CC: Snort <[email protected]>; Al Lewis (allewi)
> <[email protected]>
> SUBJECT: Re: [Snort-users] Snort3, syslog, and some additional
> questions
> 
> I'm sorry...I must have missed your question?  What was it?
> 
> On 2022-01-19 12:30, Russ Combs (rucombs) wrote:
>> James,
>> 
>>  I've responded to that. You haven't answered my questions.
>> 
>>  Russ
>> 
>> -------------------------
>> 
>> FROM: James Lay <[email protected]>
>> SENT: Wednesday, January 19, 2022 1:50 PM
>> TO: Russ Combs (rucombs) <[email protected]>
>> CC: Snort <[email protected]>; Al Lewis (allewi)
>> <[email protected]>
>> SUBJECT: Re: [Snort-users] Snort3, syslog, and some additional
>> questions
>> 
>> Wow...ok I guess I didn't specify this well at all.  To sum it up:
>> 
>> Snort 3 on linux...WHERE exactly do you specify the remote IP to
> send
>> snort alert output to?
>> 
>> Here's the only info I have:
>> 
>> 10.6. alert_syslog
>> --------------
>> Help: output event to syslog
>> Type: logger
>> Usage: global
>> Configuration:
>> 
>>    * enum alert_syslog.facility = auth: part of priority applied to
>>      each message { auth | authpriv | daemon | user | local0 |
> local1
>>      | local2 | local3 | local4 | local5 | local6 | local7 }
>>    * enum alert_syslog.level = info: part of priority applied to
> each
>>      message { emerg | alert | crit | err | warning | notice | info
> |
>>      debug }
>>    * multi alert_syslog.options: used to open the syslog connection
> {
>>      cons | ndelay | perror | pid }
>> 
>> There...that should do it..thank you :)
>> 
>> James
>> 
>> On 2022-01-19 11:23, Russ Combs (rucombs) wrote:
>>> James,
>>> 
>>>  I'm not sure we are talking about the same thing. I'm saying the
>>> difference in functionality is that Snort 2 emits a warning and
>> Snort
>>> 3 emits an error. That difference is intentional and will remain.
>>> 
>>>  To be clear, you are saying "output alert_syslog: host" is working
>>> for Snort 2 on Linux? Are you not seeing the warning on Linux like
>> the
>>> one shown below? Does it still work if you remove the host
>>> specification?
>>> 
>>>  Russ
>>> 
>>> -------------------------
>>> 
>>> FROM: James Lay <[email protected]>
>>> SENT: Wednesday, January 19, 2022 10:31 AM
>>> TO: Russ Combs (rucombs) <[email protected]>
>>> CC: Snort <[email protected]>; Al Lewis (allewi)
>>> <[email protected]>
>>> SUBJECT: Re: [Snort-users] Snort3, syslog, and some additional
>>> questions
>>> 
>>> This is on linux....no issues with snort 2, but I'd like to not
> have
>>> to
>>> futz with my rsyslog/syslog-ng configs just for snort.  The snort 2
>>> functionality should be the same in snort 3.  In my opinion.
>>> 
>>> James
>>> 
>>> On 2022-01-18 07:58, Russ Combs (rucombs) wrote:
>>>> James,
>>>> 
>>>> output alert_syslog: host is Snort 2 feature for Windows only.
>> Snort
>>> 3
>>>> does not support Windows at present.
>>>> 
>>>> If you have that in your non-Windows Snort 2 config, you should be
>>>> getting a warning like this in your startup output:
>>>> 
>>>>      WARNING: etc/snort.conf (538) => Unrecognized syslog
>>>> facility/priority: host=10.1.1.1:514,
>>>> 
>>>>  Russ
>>>> 
>>>> -------------------------
>>>> 
>>>> FROM: Snort-users <[email protected]> on behalf
>> of
>>>> Al Lewis (allewi) via Snort-users <[email protected]>
>>>> SENT: Monday, January 17, 2022 1:31 PM
>>>> TO: [email protected] <[email protected]>; Snort
>>>> <[email protected]>
>>>> SUBJECT: Re: [Snort-users] Snort3, syslog, and some additional
>>>> questions
>>>> 
>>>> I went into the source code to see if the option was there and not
>>>> missing in the help section somehow.
>>>> 
>>>> The options listed in the snort documents are the ones available.
>>>> 
>>>> ALBERT LEWIS
>>>> 
>>>> ENGINEER.SOFTWARE ENGINEERING
>>>> 
>>>> Cisco Systems Inc.
>>>> 
>>>> Email: [email protected]
>>>> 
>>>> FROM: James Lay <[email protected]>
>>>> REPLY-TO: James Lay <[email protected]>
>>>> DATE: Monday, January 17, 2022 at 12:46 PM
>>>> TO: "Al Lewis (allewi)" <[email protected]>, Snort
>>>> <[email protected]>
>>>> SUBJECT: Re: [Snort-users] Snort3, syslog, and some additional
>>>> questions
>>>> 
>>>> Thanks for the response Al.  This brings up a couple points:
>>>> 
>>>> This is, in fact, a downgrade compared to snort 2.  I've never
>>>> understood new software version that remove functionality from the
>>>> older version.
>>>> 
>>>> The fact that you had to go to the source code to get the
>>>> info......why?  Why isn't this information IN the snort docs?
> Does
>>>> Cisco really expect users to have to go pouring into the source
>> just
>>>> got get an answer?
>>>> 
>>>> So....after that, please consider this a feature request...to put
>>> BACK
>>>> the ability of being able to have snort3 natively syslog.  Thanks
>>> Al!
>>>> 
>>>> James
>>>> 
>>>> On Mon, 2022-01-17 at 17:16 +0000, Al Lewis (allewi) wrote:
>>>> 
>>>>> The logs are written locally. A quick glance at alert_syslog.cc
>>>>> suggests you may need rsyslogd (or something similar) running to
>>>>> have them forwarded elsewhere.
>>>>> 
>>>>> ALBERT LEWIS
>>>>> 
>>>>> ENGINEER.SOFTWARE ENGINEERING
>>>>> 
>>>>> Cisco Systems Inc.
>>>>> 
>>>>> Email: [email protected]
>>>>> 
>>>>> FROM: Snort-users <[email protected]> on behalf
>>> of
>>>>> James Lay <[email protected]>
>>>>> REPLY-TO: James Lay <[email protected]>
>>>>> DATE: Monday, January 17, 2022 at 10:47 AM
>>>>> TO: Snort <[email protected]>
>>>>> SUBJECT: [Snort-users] Snort3, syslog, and some additional
>>> questions
>>>>> 
>>>>> 
>>>>> So....after about 20 minutes of searching, I'm no closer to
>>>>> discovering where exactly to specify the syslog server.  Some
>> links
>>>>> I've stumbled on:
>>>>> 
>>>>> https://github.com/snort3/snort3/issues/216
>>>>> 
>>>>> and from:
>>>>> 
>>>>> https://www.snort.org/snort3
>>>>> 
>>>>> the entire bit about alert.syslog:
>>>>> 
>>>>> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>>>>> 
>>>>> alert_syslog
>>>>> 
>>>>> Help: output event to syslog
>>>>> 
>>>>> Type: logger
>>>>> 
>>>>> Usage: global
>>>>> 
>>>>> Configuration:
>>>>> 
>>>>> enum alert_syslog.facility = auth: part of priority applied to
>> each
>>>>> message { auth | authpriv | daemon | user | local0 | local1 |
>>> local2
>>>>> | local3 | local4 | local5 | local6 | local7 }
>>>>> 
>>>>> enum alert_syslog.level = info: part of priority applied to each
>>>>> message { emerg | alert | crit | err | warning | notice | info |
>>>>> debug }
>>>>> 
>>>>> multi alert_syslog.options: used to open the syslog connection {
>>>>> cons | ndelay | perror | pid }
>>>>> 
>>>>> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>>>>> 
>>>>> No where does this specify how to specify the host.
>>>>> 
>>>>> So my questions:
>>>>> 
>>>>> Why are there NO examples of usage in the reference?
>>>>> 
>>>>> Where do I specify the server?
>>>>> 
>>>>> Thank you.
>>>>> 
>>>>> James
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette