Re: Fwd: Snort 2.9.x ruletype logging output question
Fatih USTA via Snort-users <[email protected]>
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <[email protected]> |
These are my command line options. -D -d -i eth2 -u snort -g snort -c /etc/snort.conf -l /var/log/snort Permission of directory drwxr-xr-x 2 snort snort 4096 Şub 1 17:52 /var/log/snort Permission of file -rw------- 1 snort snort 0 Şub 1 17:52 snort_unified.log.1643727125 -c <rules> Use Rules File <rules> -d Dump the Application Layer -D Run Snort in background (daemon) mode -g <gname> Run snort gid as <gname> group (or gid) after initialization -i <if> Listen on interface <if> -l <ld> Log to directory <ld> -L <file> Log to this tcpdump file -u <uname> Run snort uid as <uname> user (or uid) after initialization Regards Fatih USTA On 1.02.2022 17:59, Dorian ROSSE wrote: > This isn't fully the same lines of command, > > Do you had -l option or uppercase -L option (I don't remember if this > is a L letter lowercase or uppercase) for create log when you launch > snort ? > > I hope your success, > > Regards. > > > Dorian Rosse. > ------------------------------------------------------------------------ > *From:* Fatih USTA <[email protected]> > *Sent:* Tuesday, February 1, 2022 3:51:26 PM > *To:* Dorian ROSSE <[email protected]>; > [email protected] <[email protected]> > *Subject:* Re: [Snort-users] Fwd: Snort 2.9.x ruletype logging output > question > > I already tried this config. (I think, this is almost same as my first > config) Service starting without any error. But I can't see any alert > of signature. > > > Fatih USTA > On 1.02.2022 17:13, Dorian ROSSE wrote: >> Try with this : >> >> ruletype my_alert { >> type alert >> output log_unified2 : filename snort_unified.log, limit 128 >> output alert_syslog : LOG_AUTH LOG_ALERT >> } >> >> my_alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS(msg:"ET >> WEB_SPECIFIC_APPS User Agent (SQLi Injection /Scanning)"; >> flow:established,to_server; content:"User-Agent|3a20|testitest"; >> http_header; >> fast_pattern;reference:url,en.wikipedia.org/wiki/SQL_injection >> <http://en.wikipedia.org/wiki/SQL_injection>;classtype:web-application-attack; >> sid:2023351; rev:1;metadata:attack_target SQL_Server, created_at >> 2016_10_19,deployment Datacenter, performance_impact Low, >> signature_severityMajor, updated_at 2020_07_31;) >> >> I hope your success, >> >> Regards. >> >> >> Dorian Rosse. >> ------------------------------------------------------------------------ >> *From:* Fatih USTA <[email protected]> <mailto:[email protected]> >> *Sent:* Tuesday, February 1, 2022 2:59:36 PM >> *To:* Dorian ROSSE <[email protected]> >> <mailto:[email protected]>; [email protected] >> <mailto:[email protected]> <[email protected]> >> <mailto:[email protected]> >> *Subject:* Re: [Snort-users] Fwd: Snort 2.9.x ruletype logging output >> question >> >> Hello, >> >> I copied and pasted into my config. But didn't worked. >> >> >> Unknown output plugin "unified2 log_unified2" >> >> Unknown output plugin "alert_syslog log_syslog" >> >> Fatal Error, Quitting.. >> >> >> Output plugin is plugged in... >> ------------------------------------------------- >> Keyword | Output @ >> ------------------------------------------------- >> alert_syslog : 0x80ae428 >> log_tcpdump : 0x80b3d88 >> alert_fast : 0x80ad590 >> alert_full : 0x80adde4 >> alert_unixsock: 0x80b2718 >> alert_CSV : 0x80b2c24 >> log_null : 0x80b3d18 >> log_unified2 : 0x80b7496 >> alert_unified2: 0x80b738a >> unified2 : 0x80b46dc >> log_ascii : 0x80b7a30 >> alert_sf_socket: 0x80b880c >> alert_sf_socket_sid: 0x80b8b83 >> alert_test : 0x80b92e8 >> alert_fwsam : 0x80af4c4 >> >> >> Fatih USTA >> On 1.02.2022 15:20, Dorian ROSSE via Snort-users wrote: >>> Hello, >>> >>> >>> You forbid to log to a program with underscore then the program who >>> is use as a log : >>> >>> For example with syslog : >>> >>> log_syslog >>> >>> Finally if unified and syslog are use as a logger your rule is typed >>> like these : >>> >>> output unified2: filename snort_unified.log, limit 128 >>> >>> ruletype my_alert { >>> type alert >>> output unified2 log_unified2 : filename snort_unified.log, limit 128 >>> output alert_syslog log_syslog : log_auth log_alert >>> } >>> >>> my_alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS(msg:"ET >>> WEB_SPECIFIC_APPS User Agent (SQLi Injection /Scanning)"; >>> flow:established,to_server; content:"User-Agent|3a20|testitest"; >>> http_header; >>> fast_pattern;reference:url,en.wikipedia.org/wiki/SQL_injection >>> <http://en.wikipedia.org/wiki/SQL_injection>;classtype:web-application-attack; >>> sid:2023351; rev:1;metadata:attack_target SQL_Server, created_at >>> 2016_10_19,deployment Datacenter, performance_impact Low, >>> signature_severityMajor, updated_at 2020_07_31;) >>> >>> I hope success your problem, >>> >>> Regards. >>> >>> >>> Dorian Rosse. >>> >>> _______________________________________________ >>> Snort-users mailing list >>> [email protected] <mailto:[email protected]> >>> Go to this URL to change user options or unsubscribe: >>> https://lists.snort.org/mailman/listinfo/snort-users <https://lists.snort.org/mailman/listinfo/snort-users> >>> >>> To unsubscribe, send an email to: >>> [email protected] <mailto:[email protected]> >>> >>> Please visithttp://blog.snort.org <http://blog.snort.org> to stay current on all the latest Snort news! >>> >>> Please follow these rules:https://snort.org/faq/what-is-the-mailing-list-etiquette <https://snort.org/faq/what-is-the-mailing-list-etiquette> _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette