Re: Snort 2.9.x ruletype logging output question

Joel Esler via Snort-users <[email protected]> Wed, 2 Feb 2022 13:52:18 -0500
Newsgroups	gmane.comp.security.ids.snort.general
Message-ID	<[email protected]>
If you are setting an output option in your command settings, it should override your .conf settings.  (Do as much in the .conf file as you can)

> On Feb 1, 2022, at 10:22 AM, Fatih USTA via Snort-users <[email protected]> wrote:
> 
> I tried but nothing changed. I think, option '-A' is not related of my issue.
> 
>         -A         Set alert mode: fast, full, console, test or none  (alert file alerts only)
>                    "unsock" enables UNIX socket logging (experimental).
> 
> 
> Fatih USTA
> On 1.02.2022 18:14, Dorian ROSSE wrote:
>> You forgot -A or lowercase -a for alert,
>> 
>> I hope your success,
>> 
>> Regards.
>> 
>> 
>> Dorian Rosse.
>> From: Fatih USTA <[email protected]> <mailto:[email protected]>
>> Sent: Tuesday, February 1, 2022 4:08:55 PM
>> To: Dorian ROSSE <[email protected]> <mailto:[email protected]>; [email protected] <mailto:[email protected]> <[email protected]> <mailto:[email protected]>
>> Subject: Re: [Snort-users] Fwd: Snort 2.9.x ruletype logging output question
>>  
>> 
>> 
>> These are my command line options.
>> 
>> -D -d -i eth2 -u snort -g snort -c /etc/snort.conf -l /var/log/snort
>> 
>> Permission of directory
>> drwxr-xr-x 2 snort snort    4096 Şub  1 17:52 /var/log/snort
>> 
>> Permission of file
>> 
>> -rw------- 1 snort snort     0 Şub  1 17:52 snort_unified.log.1643727125
>> 
>> 
>>         -c <rules> Use Rules File <rules>
>>         -d         Dump the Application Layer
>>         -D         Run Snort in background (daemon) mode
>>         -g <gname> Run snort gid as <gname> group (or gid) after initialization
>>         -i <if>    Listen on interface <if>
>>         -l <ld>    Log to directory <ld>
>>         -L <file>  Log to this tcpdump file
>>         -u <uname> Run snort uid as <uname> user (or uid) after initialization
>> 
>> Regards
>> 
>> Fatih USTA
>> On 1.02.2022 17:59, Dorian ROSSE wrote:
>>> This isn't fully the same lines of command,
>>> 
>>> Do you had -l option or uppercase -L option (I don't remember if this is a L letter lowercase or uppercase) for create log when you launch snort ?
>>> 
>>> I hope your success,
>>> 
>>> Regards.
>>> 
>>> 
>>> Dorian Rosse.
>>> From: Fatih USTA <[email protected]> <mailto:[email protected]>
>>> Sent: Tuesday, February 1, 2022 3:51:26 PM
>>> To: Dorian ROSSE <[email protected]> <mailto:[email protected]>; [email protected] <mailto:[email protected]> <[email protected]> <mailto:[email protected]>
>>> Subject: Re: [Snort-users] Fwd: Snort 2.9.x ruletype logging output question
>>>  
>>> I already tried this config. (I think, this is almost same as my first config) Service starting without any error. But I can't see any alert of signature.
>>> 
>>> 
>>> 
>>> Fatih USTA
>>> On 1.02.2022 17:13, Dorian ROSSE wrote:
>>>> Try with this :
>>>> 
>>>> ruletype my_alert {
>>>> type alert
>>>> output log_unified2 : filename snort_unified.log, limit 128
>>>> output alert_syslog : LOG_AUTH LOG_ALERT
>>>> }
>>>> 
>>>> my_alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS User Agent (SQLi Injection / Scanning)"; flow:established,to_server; content:"User-Agent|3a 20|testitest"; http_header; fast_pattern; reference:url,en.wikipedia.org/wiki/SQL_injection <http://en.wikipedia.org/wiki/SQL_injection>; classtype:web-application-attack; sid:2023351; rev:1; metadata:attack_target SQL_Server, created_at 2016_10_19, deployment Datacenter, performance_impact Low, signature_severity Major, updated_at 2020_07_31;)
>>>> 
>>>> I hope your success,
>>>> 
>>>> Regards.
>>>> 
>>>> 
>>>> Dorian Rosse.
>>>> From: Fatih USTA <[email protected]> <mailto:[email protected]>
>>>> Sent: Tuesday, February 1, 2022 2:59:36 PM
>>>> To: Dorian ROSSE <[email protected]> <mailto:[email protected]>; [email protected] <mailto:[email protected]> <[email protected]> <mailto:[email protected]>
>>>> Subject: Re: [Snort-users] Fwd: Snort 2.9.x ruletype logging output question
>>>>  
>>>> Hello,
>>>> 
>>>> I copied and pasted into my config. But didn't worked.
>>>> 
>>>> 
>>>> 
>>>> Unknown output plugin "unified2 log_unified2"
>>>> 
>>>> Unknown output plugin "alert_syslog log_syslog"
>>>> 
>>>> Fatal Error, Quitting..
>>>> 
>>>> 
>>>> 
>>>> Output plugin is plugged in...
>>>> -------------------------------------------------
>>>>  Keyword     |          Output @ 
>>>> -------------------------------------------------
>>>> alert_syslog :       0x80ae428
>>>> log_tcpdump  :       0x80b3d88
>>>> alert_fast   :       0x80ad590
>>>> alert_full   :       0x80adde4
>>>> alert_unixsock:       0x80b2718
>>>> alert_CSV    :       0x80b2c24
>>>> log_null     :       0x80b3d18
>>>> log_unified2 :       0x80b7496
>>>> alert_unified2:       0x80b738a
>>>> unified2     :       0x80b46dc
>>>> log_ascii    :       0x80b7a30
>>>> alert_sf_socket:       0x80b880c
>>>> alert_sf_socket_sid:       0x80b8b83
>>>> alert_test   :       0x80b92e8
>>>> alert_fwsam  :       0x80af4c4
>>>> 
>>>> 
>>>> 
>>>> Fatih USTA
>>>> On 1.02.2022 15:20, Dorian ROSSE via Snort-users wrote:
>>>>> Hello,
>>>>> 
>>>>> 
>>>>> You forbid to log to a program with underscore then the program who is use as a log :
>>>>> 
>>>>> For example with syslog :
>>>>> 
>>>>> log_syslog
>>>>> 
>>>>> Finally if unified and syslog are use as a logger your rule is typed like these :
>>>>> 
>>>>> output unified2: filename snort_unified.log, limit 128
>>>>> 
>>>>> ruletype my_alert {
>>>>> type alert
>>>>> output unified2 log_unified2 : filename snort_unified.log, limit 128
>>>>> output alert_syslog log_syslog : log_auth log_alert
>>>>> }
>>>>> 
>>>>> my_alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS User Agent (SQLi Injection / Scanning)"; flow:established,to_server; content:"User-Agent|3a 20|testitest"; http_header; fast_pattern; reference:url,en.wikipedia.org/wiki/SQL_injection <http://en.wikipedia.org/wiki/SQL_injection>; classtype:web-application-attack; sid:2023351; rev:1; metadata:attack_target SQL_Server, created_at 2016_10_19, deployment Datacenter, performance_impact Low, signature_severity Major, updated_at 2020_07_31;)
>>>>> 
>>>>> I hope success your problem,
>>>>> 
>>>>> Regards.
>>>>> 
>>>>> 
>>>>> Dorian Rosse.
>>>>> 
>>>>> 
>>>>> _______________________________________________
>>>>> Snort-users mailing list
>>>>> [email protected] <mailto:[email protected]>
>>>>> Go to this URL to change user options or unsubscribe:
>>>>> https://lists.snort.org/mailman/listinfo/snort-users <https://lists.snort.org/mailman/listinfo/snort-users>
>>>>> 
>>>>> 	To unsubscribe, send an email to:
>>>>> 	[email protected] <mailto:[email protected]>
>>>>> 
>>>>> Please visit http://blog.snort.org <http://blog.snort.org/> to stay current on all the latest Snort news!
>>>>> 
>>>>> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette <https://snort.org/faq/what-is-the-mailing-list-etiquette>
> _______________________________________________
> Snort-users mailing list
> [email protected]
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
> 
> 	To unsubscribe, send an email to:
> 	[email protected]
> 
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
> 
> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette