Re: Snort3, syslog, and some additional questions

Appreciate the patience with me on this....not groking and reading too 
fast....ACK on host = being a windows only feature thank you.

James

On 2022-01-19 17:48, Patrick Mullen (pamullen) wrote:
> James,
> 
> But the code for specifying 'host' in snort 2 is conditionally
> compiled to Windows only.  Are you running snort 2 on a windows host?
> The linux behavior between snort 2 and snort 3 as it pertains to
> syslog is unchanged (and windows is unsupported in snort 3).
> 
> Using this guide to set up remote syslogs and configuring the facility
> of syslog messages in snort would make it so you only sent your snort
> messages to the remote syslog server.
> https://linuxhint.com/send_linux_logs_remote_server/
> 
> 
> Thanks,
> 
> ~Patrick
> 
> 
> -----Original Message-----
> From: James Lay <[email protected]>
> Sent: Wednesday, January 19, 2022 4:26 PM
> To: Patrick Mullen (pamullen) <[email protected]>
> Cc: Russ Combs (rucombs) <[email protected]>; 
> [email protected]
> Subject: Re: [Snort-users] Snort3, syslog, and some additional 
> questions
> 
> Thanks Patrick!
> 
> So.....per the snort 2 syslog option docs:
> 
> output alert_syslog: host=10.1.1.1:514, <facility> <priority> <options>
> 
> I can indeed specify which syslog server to go to.  This...this is
> what I'm asking for/about for snort 3.
> 
> Thanks again...and long time no chat, I have been good.  Busy....but 
> good :)
> 
> James
> 
> On 2022-01-19 14:15, Patrick Mullen (pamullen) wrote:
>> James,
>> 
>> How have you been?  I hope you are well.  It's been too long since
>> we've chatted.
>> 
>> The way this is handled on Snort 3 (which is the way it's handled in
>> Snort 2 on non-Windows devices) is the alerts are logged to the local
>> syslog, and the local syslog would then be configured to send those
>> alerts to a remote syslog server if that's what you want to do.  By
>> doing it this way, it allows Snort to hand the information off to the
>> local logging facility and get back to work doing detection while the
>> OS can handle all of the network communications and the rest regarding
>> the logs.  Make sense?
>> 
>> Let me know if you have any questions.  Glad to see you're out there
>> kicking the tires!
>> 
>> Thanks,
>> 
>> ~Patrick
>> 
>> -------------------------
>> 
>> FROM: James Lay <[email protected]>
>> SENT: Wednesday, January 19, 2022 2:39 PM
>> TO: Russ Combs (rucombs) <[email protected]>
>> CC: Snort <[email protected]>; Al Lewis (allewi)
>> <[email protected]>
>> SUBJECT: Re: [Snort-users] Snort3, syslog, and some additional
>> questions
>> 
>> I'm sorry...I must have missed your question?  What was it?
>> 
>> On 2022-01-19 12:30, Russ Combs (rucombs) wrote:
>>> James,
>>> 
>>>  I've responded to that. You haven't answered my questions.
>>> 
>>>  Russ
>>> 
>>> -------------------------
>>> 
>>> FROM: James Lay <[email protected]>
>>> SENT: Wednesday, January 19, 2022 1:50 PM
>>> TO: Russ Combs (rucombs) <[email protected]>
>>> CC: Snort <[email protected]>; Al Lewis (allewi)
>>> <[email protected]>
>>> SUBJECT: Re: [Snort-users] Snort3, syslog, and some additional
>>> questions
>>> 
>>> Wow...ok I guess I didn't specify this well at all.  To sum it up:
>>> 
>>> Snort 3 on linux...WHERE exactly do you specify the remote IP to
>> send
>>> snort alert output to?
>>> 
>>> Here's the only info I have:
>>> 
>>> 10.6. alert_syslog
>>> --------------
>>> Help: output event to syslog
>>> Type: logger
>>> Usage: global
>>> Configuration:
>>> 
>>>    * enum alert_syslog.facility = auth: part of priority applied to
>>>      each message { auth | authpriv | daemon | user | local0 |
>> local1
>>>      | local2 | local3 | local4 | local5 | local6 | local7 }
>>>    * enum alert_syslog.level = info: part of priority applied to
>> each
>>>      message { emerg | alert | crit | err | warning | notice | info
>> |
>>>      debug }
>>>    * multi alert_syslog.options: used to open the syslog connection
>> {
>>>      cons | ndelay | perror | pid }
>>> 
>>> There...that should do it..thank you :)
>>> 
>>> James
>>> 
>>> On 2022-01-19 11:23, Russ Combs (rucombs) wrote:
>>>> James,
>>>> 
>>>>  I'm not sure we are talking about the same thing. I'm saying the
>>>> difference in functionality is that Snort 2 emits a warning and
>>> Snort
>>>> 3 emits an error. That difference is intentional and will remain.
>>>> 
>>>>  To be clear, you are saying "output alert_syslog: host" is working
>>>> for Snort 2 on Linux? Are you not seeing the warning on Linux like
>>> the
>>>> one shown below? Does it still work if you remove the host
>>>> specification?
>>>> 
>>>>  Russ
>>>> 
>>>> -------------------------
>>>> 
>>>> FROM: James Lay <[email protected]>
>>>> SENT: Wednesday, January 19, 2022 10:31 AM
>>>> TO: Russ Combs (rucombs) <[email protected]>
>>>> CC: Snort <[email protected]>; Al Lewis (allewi)
>>>> <[email protected]>
>>>> SUBJECT: Re: [Snort-users] Snort3, syslog, and some additional
>>>> questions
>>>> 
>>>> This is on linux....no issues with snort 2, but I'd like to not
>> have
>>>> to
>>>> futz with my rsyslog/syslog-ng configs just for snort.  The snort 2
>>>> functionality should be the same in snort 3.  In my opinion.
>>>> 
>>>> James
>>>> 
>>>> On 2022-01-18 07:58, Russ Combs (rucombs) wrote:
>>>>> James,
>>>>> 
>>>>> output alert_syslog: host is Snort 2 feature for Windows only.
>>> Snort
>>>> 3
>>>>> does not support Windows at present.
>>>>> 
>>>>> If you have that in your non-Windows Snort 2 config, you should be
>>>>> getting a warning like this in your startup output:
>>>>> 
>>>>>      WARNING: etc/snort.conf (538) => Unrecognized syslog
>>>>> facility/priority: host=10.1.1.1:514,
>>>>> 
>>>>>  Russ
>>>>> 
>>>>> -------------------------
>>>>> 
>>>>> FROM: Snort-users <[email protected]> on behalf
>>> of
>>>>> Al Lewis (allewi) via Snort-users <[email protected]>
>>>>> SENT: Monday, January 17, 2022 1:31 PM
>>>>> TO: [email protected] <[email protected]>; Snort
>>>>> <[email protected]>
>>>>> SUBJECT: Re: [Snort-users] Snort3, syslog, and some additional
>>>>> questions
>>>>> 
>>>>> I went into the source code to see if the option was there and not
>>>>> missing in the help section somehow.
>>>>> 
>>>>> The options listed in the snort documents are the ones available.
>>>>> 
>>>>> ALBERT LEWIS
>>>>> 
>>>>> ENGINEER.SOFTWARE ENGINEERING
>>>>> 
>>>>> Cisco Systems Inc.
>>>>> 
>>>>> Email: [email protected]
>>>>> 
>>>>> FROM: James Lay <[email protected]>
>>>>> REPLY-TO: James Lay <[email protected]>
>>>>> DATE: Monday, January 17, 2022 at 12:46 PM
>>>>> TO: "Al Lewis (allewi)" <[email protected]>, Snort
>>>>> <[email protected]>
>>>>> SUBJECT: Re: [Snort-users] Snort3, syslog, and some additional
>>>>> questions
>>>>> 
>>>>> Thanks for the response Al.  This brings up a couple points:
>>>>> 
>>>>> This is, in fact, a downgrade compared to snort 2.  I've never
>>>>> understood new software version that remove functionality from the
>>>>> older version.
>>>>> 
>>>>> The fact that you had to go to the source code to get the
>>>>> info......why?  Why isn't this information IN the snort docs?
>> Does
>>>>> Cisco really expect users to have to go pouring into the source
>>> just
>>>>> got get an answer?
>>>>> 
>>>>> So....after that, please consider this a feature request...to put
>>>> BACK
>>>>> the ability of being able to have snort3 natively syslog.  Thanks
>>>> Al!
>>>>> 
>>>>> James
>>>>> 
>>>>> On Mon, 2022-01-17 at 17:16 +0000, Al Lewis (allewi) wrote:
>>>>> 
>>>>>> The logs are written locally. A quick glance at alert_syslog.cc
>>>>>> suggests you may need rsyslogd (or something similar) running to
>>>>>> have them forwarded elsewhere.
>>>>>> 
>>>>>> ALBERT LEWIS
>>>>>> 
>>>>>> ENGINEER.SOFTWARE ENGINEERING
>>>>>> 
>>>>>> Cisco Systems Inc.
>>>>>> 
>>>>>> Email: [email protected]
>>>>>> 
>>>>>> FROM: Snort-users <[email protected]> on behalf
>>>> of
>>>>>> James Lay <[email protected]>
>>>>>> REPLY-TO: James Lay <[email protected]>
>>>>>> DATE: Monday, January 17, 2022 at 10:47 AM
>>>>>> TO: Snort <[email protected]>
>>>>>> SUBJECT: [Snort-users] Snort3, syslog, and some additional
>>>> questions
>>>>>> 
>>>>>> 
>>>>>> So....after about 20 minutes of searching, I'm no closer to
>>>>>> discovering where exactly to specify the syslog server.  Some
>>> links
>>>>>> I've stumbled on:
>>>>>> 
>>>>>> https://github.com/snort3/snort3/issues/216
>>>>>> 
>>>>>> and from:
>>>>>> 
>>>>>> https://www.snort.org/snort3
>>>>>> 
>>>>>> the entire bit about alert.syslog:
>>>>>> 
>>>>>> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>>>>>> 
>>>>>> alert_syslog
>>>>>> 
>>>>>> Help: output event to syslog
>>>>>> 
>>>>>> Type: logger
>>>>>> 
>>>>>> Usage: global
>>>>>> 
>>>>>> Configuration:
>>>>>> 
>>>>>> enum alert_syslog.facility = auth: part of priority applied to
>>> each
>>>>>> message { auth | authpriv | daemon | user | local0 | local1 |
>>>> local2
>>>>>> | local3 | local4 | local5 | local6 | local7 }
>>>>>> 
>>>>>> enum alert_syslog.level = info: part of priority applied to each
>>>>>> message { emerg | alert | crit | err | warning | notice | info |
>>>>>> debug }
>>>>>> 
>>>>>> multi alert_syslog.options: used to open the syslog connection {
>>>>>> cons | ndelay | perror | pid }
>>>>>> 
>>>>>> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>>>>>> 
>>>>>> No where does this specify how to specify the host.
>>>>>> 
>>>>>> So my questions:
>>>>>> 
>>>>>> Why are there NO examples of usage in the reference?
>>>>>> 
>>>>>> Where do I specify the server?
>>>>>> 
>>>>>> Thank you.
>>>>>> 
>>>>>> James
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette