Re: [sentinix-list] Output database

Please read the SnortCenter documentation at:  
http://users.pandora.be/larc/documentation/

You need to configure your SnortCenter Sensor Agent from the SnortCenter 
web-interface.  If you want to use SnortCenter, _DO NOT_ edit any snort.conf 
file by hand, _learn_ to use SnortCenter instead, it really is _extremely_ 
much simpler than editing snort.conf by hand!!!  That's why SnortCenter is in 
the distro!!!  You can also distribute the config to all other sensors you 
have out there, and each config can be sensor-specific - individually 
crufted!   It _is_ an admin's goldmine, but only if you actually use it!!!

For SnortCenter Sensor Agent passwords and other Sensor-specific config, see 
it's config. Since I currently don't have sentinix compiled anywhere, I 
_think_ it's under /usr/local/snort/snortcenter/sensor/... not 100% sure 
though.

	Michel

On Wednesday 07 January 2004 16:22, M. Morgan wrote:
> Hmm that looks like it could be it. I've also been looking at the
> /etc/snort/snort.conf file,
>
> <snip>
> ####################################################################
> # Step #3: Configure output plugins
> #
> # Uncomment and configure the output plugins you decide to use.
> # General configuration for output plugins is of the form:
> #
> # output <name_of_plugin>: <configuration_options>
> #
> # alert_syslog: log alerts to syslog
> # ----------------------------------
> # Use one or more syslog facilities as arguments
> #
> # output alert_syslog: LOG_AUTH LOG_ALERT
>
> # log_tcpdump: log packets in binary tcpdump format
> # -------------------------------------------------
> # The only argument is the output file name.
> #
> # output log_tcpdump: tcpdump.log
>
> # database: log to a variety of databases
> # ---------------------------------------
> # See the README.database file for more information about configuring
> # and using this plugin.
> #
> # output database: log, mysql, user=root password=test dbname=db
> host=localhost # output database: alert, postgresql, user=snort
> dbname=snort
> # output database: log, unixodbc, user=snort dbname=snort
> # output database: log, mssql, dbname=snort user=snort password=test
> <snip>
>
> It looks like this line:
> output database: log, mysql, user=root password=test dbname=db
> host=localhost
>
> should read:
>
> output database: log, mysql, user=snort password=sentinix dbname=snort_db
> host=192.168.x.x
>
> or something along those lines.
>
> I'm referencing this document config settings:
> http://www.andrew.cmu.edu/~rdanyliw/snort/snortdb/snortdb_config.html
>
> Ill post back as this progresses.
>
> Thanks,
> Michael
>
>
> -----Original Message-----
> From: "Terkanian, Greg" <[email protected]>
> Sent: Jan 7, 2004 9:32 AM
> To: "M. Morgan" <[email protected]>,
> 	The SENTINIX Mailing List <[email protected]>
> Subject: RE: [sentinix-list] Output database
>
> I think the file you're looking for is
> /usr/local/snort/snortcenter/config.php
>
>
> -----Original Message-----
> From: sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org
> [mailto:sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org]On Behalf Of M. Morgan
> Sent: Wednesday, January 07, 2004 7:56 AM
> To: [email protected]
> Subject: [sentinix-list] Output database
>
>
> Hello all,
>  I'm trying to configure a remote sensor to log into a database on a
> seperate server.
>
>  Obviously I need to edit the output database config file but I cant seem
> to find it.
>
> Anyone have a quick and dirty how-to or the path to the file?
>
> here is the default line from snortcenter:
>
> output database: alert, mysql, user=snort password=sentinix dbname=snort
> host=localhost port=3306 sensor_name=[AUTO]
>
> I cant edit it in snort center though and need to reconfigure it to point
> to a different server.
>
> Many thanks!
>
> Michael
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix
>
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix