Re: Log trouble
"Al Lewis \(allewi\) via Snort-users" <[email protected]> Wed, 8 Jan 2025 15:19:23 +0000
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <BL3PR11MB5715099815B63AB96BC656CFDA122@BL3PR11MB5715.namprd11.prod.outlook.com> |
--===============0991419638452287660== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_BL3PR11MB5715099815B63AB96BC656CFDA122BL3PR11MB5715namp_" --_000_BL3PR11MB5715099815B63AB96BC656CFDA122BL3PR11MB5715namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Can you share the config you are using? Albert Lewis Email: [email protected]<mailto:[email protected]> ________________________________ From: Snort-users <[email protected]> on behalf of Jacko = B via Snort-users <[email protected]> Sent: Tuesday, January 7, 2025 10:08 AM To: Snort users <[email protected]> Subject: [Snort-users] Log trouble Hello everyone, I was wondering if anyone had any suggestions for some logg= ing trouble I am having. I am using snort++ version 3.6.0.0 After installing I tried to set up logs for alerts to output to. I wanted t= o encrypt the logs and rotate them every 90 days so I set that up and then = configured lua where to output. My configuration passes and snort runs succ= essfully but I can't seem to log anything. I added a custom rule for testin= g purposes that alert "any any ip" and finally today I was able to trigger = an alert but still no logs. I am willing to use an alternative logging mech= anism at this point but figured I would reach out for help first. I can sen= d pics of my configuration and I appreciate any and all help. --_000_BL3PR11MB5715099815B63AB96BC656CFDA122BL3PR11MB5715namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo= ttom:0;} </style> </head> <body dir=3D"ltr"> <div class=3D"elementToProof" style=3D"font-family: "Courier New"= , monospace; font-size: 12pt; color: rgb(0, 0, 0);"> Can you share the config you are using?</div> <div class=3D"elementToProof" style=3D"font-family: "Courier New"= , monospace; font-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <div class=3D"elementToProof" style=3D"font-family: "Courier New"= , monospace; font-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <div id=3D"Signature" class=3D"elementToProof"> <p style=3D"line-height: normal; margin: 0px; font-family: Courier; font-si= ze: 16px; color: rgb(30, 73, 125);"> <b>Albert Lewis</b></p> <p style=3D"line-height: normal; margin: 0px; font-family: Courier; font-si= ze: 15px; color: rgb(127, 127, 127);"> <span style=3D"font-size: 16px; color: rgb(153, 153, 153);">Email: </span><= span style=3D"font-size: 16px; color: rgb(128, 27, 128);"><u><a href=3D"mai= lto:[email protected]" id=3D"OWA3e8a4c2d-3bda-84a2-3af6-cc2d8b173fff" class= =3D"OWAAutoLink" style=3D"color: rgb(128, 27, 128); margin-top: 0px; margin= -bottom: 0px;">[email protected]</a></u></span><span style=3D"font-size: 16p= x; color: rgb(79, 129, 189);"> </span></p> </div> <div id=3D"appendonsend"></div> <hr style=3D"display:inline-block;width:98%" tabindex=3D"-1"> <div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" st= yle=3D"font-size:11pt" color=3D"#000000"><b>From:</b> Snort-users <snort= [email protected]> on behalf of Jacko B via Snort-users <= ;[email protected]><br> <b>Sent:</b> Tuesday, January 7, 2025 10:08 AM<br> <b>To:</b> Snort users <[email protected]><br> <b>Subject:</b> [Snort-users] Log trouble</font> <div> </div> </div> <div> <div style=3D"font-size:10pt; font-family:Verdana,Arial,Helvetica,sans-seri= f; color:#000000"> <div> <div>Hello everyone, I was wondering if anyone had any suggestions for some= logging trouble I am having. I am using snort++ version 3.6.0.0</div> <div>After installing I tried to set up logs for alerts to output to. I wan= ted to encrypt the logs and rotate them every 90 days so I set that up and = then configured lua where to output. My configuration passes and snort runs= successfully but I can't seem to log anything. I added a custom rule for testing purposes that alert "= any any ip" and finally today I was able to trigger an alert but still= no logs. I am willing to use an alternative logging mechanism at this poin= t but figured I would reach out for help first. I can send pics of my configuration and I appreciate any and all help.</di= v> <br> </div> </div> <br> </div> </body> </html> --_000_BL3PR11MB5715099815B63AB96BC656CFDA122BL3PR11MB5715namp_-- --===============0991419638452287660== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette --===============0991419638452287660==--