Re: Fwd: Snort 2.9.x ruletype logging output question

I tried but nothing changed. I think, option '-A' is not related of my 
issue.

         -A         Set alert mode: fast, full, console, test or none  
(alert file alerts only)
                    "unsock" enables UNIX socket logging (experimental).

Fatih USTA

On 1.02.2022 18:14, Dorian ROSSE wrote:
> You forgot -A or lowercase -a for alert,
>
> I hope your success,
>
> Regards.
>
>
> Dorian Rosse.
> ------------------------------------------------------------------------
> *From:* Fatih USTA <[email protected]>
> *Sent:* Tuesday, February 1, 2022 4:08:55 PM
> *To:* Dorian ROSSE <[email protected]>; 
> [email protected] <[email protected]>
> *Subject:* Re: [Snort-users] Fwd: Snort 2.9.x ruletype logging output 
> question
>
>
> These are my command line options.
>
> -D -d -i eth2 -u snort -g snort -c /etc/snort.conf -l /var/log/snort
>
> Permission of directory
> drwxr-xr-x 2 snort snort    4096 Şub  1 17:52 /var/log/snort
>
> Permission of file
>
> -rw------- 1 snort snort     0 Şub  1 17:52 snort_unified.log.1643727125
>
>         -c <rules> Use Rules File <rules>
>         -d         Dump the Application Layer
>         -D         Run Snort in background (daemon) mode
>         -g <gname> Run snort gid as <gname> group (or gid) after 
> initialization
>         -i <if>    Listen on interface <if>
>         -l <ld>    Log to directory <ld>
>         -L <file>  Log to this tcpdump file
>         -u <uname> Run snort uid as <uname> user (or uid) after 
> initialization
>
> Regards
>
> Fatih USTA
> On 1.02.2022 17:59, Dorian ROSSE wrote:
>> This isn't fully the same lines of command,
>>
>> Do you had -l option or uppercase -L option (I don't remember if this 
>> is a L letter lowercase or uppercase) for create log when you launch 
>> snort ?
>>
>> I hope your success,
>>
>> Regards.
>>
>>
>> Dorian Rosse.
>> ------------------------------------------------------------------------
>> *From:* Fatih USTA <[email protected]> <mailto:[email protected]>
>> *Sent:* Tuesday, February 1, 2022 3:51:26 PM
>> *To:* Dorian ROSSE <[email protected]> 
>> <mailto:[email protected]>; [email protected] 
>> <mailto:[email protected]> <[email protected]> 
>> <mailto:[email protected]>
>> *Subject:* Re: [Snort-users] Fwd: Snort 2.9.x ruletype logging output 
>> question
>>
>> I already tried this config. (I think, this is almost same as my 
>> first config) Service starting without any error. But I can't see any 
>> alert of signature.
>>
>>
>> Fatih USTA
>> On 1.02.2022 17:13, Dorian ROSSE wrote:
>>> Try with this :
>>>
>>> ruletype my_alert {
>>> type alert
>>> output log_unified2 : filename snort_unified.log, limit 128
>>> output alert_syslog : LOG_AUTH LOG_ALERT
>>> }
>>>
>>> my_alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS(msg:"ET 
>>> WEB_SPECIFIC_APPS User Agent (SQLi Injection /Scanning)"; 
>>> flow:established,to_server; content:"User-Agent|3a20|testitest"; 
>>> http_header; 
>>> fast_pattern;reference:url,en.wikipedia.org/wiki/SQL_injection 
>>> <http://en.wikipedia.org/wiki/SQL_injection>;classtype:web-application-attack; 
>>> sid:2023351; rev:1;metadata:attack_target SQL_Server, created_at 
>>> 2016_10_19,deployment Datacenter, performance_impact Low, 
>>> signature_severityMajor, updated_at 2020_07_31;)
>>>
>>> I hope your success,
>>>
>>> Regards.
>>>
>>>
>>> Dorian Rosse.
>>> ------------------------------------------------------------------------
>>> *From:* Fatih USTA <[email protected]> 
>>> <mailto:[email protected]>
>>> *Sent:* Tuesday, February 1, 2022 2:59:36 PM
>>> *To:* Dorian ROSSE <[email protected]> 
>>> <mailto:[email protected]>; [email protected] 
>>> <mailto:[email protected]> <[email protected]> 
>>> <mailto:[email protected]>
>>> *Subject:* Re: [Snort-users] Fwd: Snort 2.9.x ruletype logging 
>>> output question
>>>
>>> Hello,
>>>
>>> I copied and pasted into my config. But didn't worked.
>>>
>>>
>>> Unknown output plugin "unified2 log_unified2"
>>>
>>> Unknown output plugin "alert_syslog log_syslog"
>>>
>>> Fatal Error, Quitting..
>>>
>>>
>>> Output plugin is plugged in...
>>> -------------------------------------------------
>>>  Keyword     |          Output @
>>> -------------------------------------------------
>>> alert_syslog :       0x80ae428
>>> log_tcpdump  :       0x80b3d88
>>> alert_fast   :       0x80ad590
>>> alert_full   :       0x80adde4
>>> alert_unixsock:       0x80b2718
>>> alert_CSV    :       0x80b2c24
>>> log_null     :       0x80b3d18
>>> log_unified2 :       0x80b7496
>>> alert_unified2:       0x80b738a
>>> unified2     :       0x80b46dc
>>> log_ascii    :       0x80b7a30
>>> alert_sf_socket:       0x80b880c
>>> alert_sf_socket_sid:       0x80b8b83
>>> alert_test   :       0x80b92e8
>>> alert_fwsam  :       0x80af4c4
>>>
>>>
>>> Fatih USTA
>>> On 1.02.2022 15:20, Dorian ROSSE via Snort-users wrote:
>>>> Hello,
>>>>
>>>>
>>>> You forbid to log to a program with underscore then the program who 
>>>> is use as a log :
>>>>
>>>> For example with syslog :
>>>>
>>>> log_syslog
>>>>
>>>> Finally if unified and syslog are use as a logger your rule is 
>>>> typed like these :
>>>>
>>>> output unified2: filename snort_unified.log, limit 128
>>>>
>>>> ruletype my_alert {
>>>> type alert
>>>> output unified2 log_unified2 : filename snort_unified.log, limit 128
>>>> output alert_syslog log_syslog : log_auth log_alert
>>>> }
>>>>
>>>> my_alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS(msg:"ET 
>>>> WEB_SPECIFIC_APPS User Agent (SQLi Injection /Scanning)"; 
>>>> flow:established,to_server; content:"User-Agent|3a20|testitest"; 
>>>> http_header; 
>>>> fast_pattern;reference:url,en.wikipedia.org/wiki/SQL_injection 
>>>> <http://en.wikipedia.org/wiki/SQL_injection>;classtype:web-application-attack; 
>>>> sid:2023351; rev:1;metadata:attack_target SQL_Server, created_at 
>>>> 2016_10_19,deployment Datacenter, performance_impact Low, 
>>>> signature_severityMajor, updated_at 2020_07_31;)
>>>>
>>>> I hope success your problem,
>>>>
>>>> Regards.
>>>>
>>>>
>>>> Dorian Rosse.
>>>>
>>>> _______________________________________________
>>>> Snort-users mailing list
>>>> [email protected]  <mailto:[email protected]>
>>>> Go to this URL to change user options or unsubscribe:
>>>> https://lists.snort.org/mailman/listinfo/snort-users  <https://lists.snort.org/mailman/listinfo/snort-users>
>>>>
>>>> 	To unsubscribe, send an email to:
>>>> 	[email protected]  <mailto:[email protected]>
>>>>
>>>> Please visithttp://blog.snort.org  <http://blog.snort.org>  to stay current on all the latest Snort news!
>>>>
>>>> Please follow these rules:https://snort.org/faq/what-is-the-mailing-list-etiquette  <https://snort.org/faq/what-is-the-mailing-list-etiquette>

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette