RE: [sentinix-list] Output database

Mike,
If you haven't found it yet, in snortcenter it's under resources, output plugins.


-----Original Message-----
From: sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org
[mailto:sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org]On Behalf Of M. Morgan
Sent: Wednesday, January 07, 2004 10:37 AM
To: The SENTINIX Mailing List; The SENTINIX Mailing List
Subject: Re: [sentinix-list] Output database


Michel,
 Snortcenter allows you to configure the "agent" but not the "output plugin". You have to configure the output plugin to tell it where a remote database is if it's not on "localhost".

 I get this from the Snortcenter documentation at:
http://users.pandora.be/larc/documentation/chap1.html

You can view the output path by opening snortcenter and going to:
-sensor console
 -view sensors
  -sensor config
   -view output plugins

Am I correct in thinking that the line of text displayed there contains the path to the database?
(localhost by default)
"output database: alert, mysql, user=snort password=sentinix dbname=snort host=localhost port=3306 sensor_name=[AUTO]"

The only option is to activate/deactivate the plugin.....

Keep in mind that Im trying to get several remote sensors to log into a central mysql database server, I assume there is functionality for this....I would think that it has been done before...

 If there is functionality in the SnortCenter GUI to do this that I'm missing please take the time to point it out. I really like doing things by the easiest method.

Thanks,
Michael

-----Original Message-----
From: Michel Blomgren <[email protected]>
Sent: Jan 7, 2004 10:32 AM
To: The SENTINIX Mailing List <[email protected]>
Subject: Re: [sentinix-list] Output database

Please read the SnortCenter documentation at:  
http://users.pandora.be/larc/documentation/

You need to configure your SnortCenter Sensor Agent from the SnortCenter 
web-interface.  If you want to use SnortCenter, _DO NOT_ edit any snort.conf 
file by hand, _learn_ to use SnortCenter instead, it really is _extremely_ 
much simpler than editing snort.conf by hand!!!  That's why SnortCenter is in 
the distro!!!  You can also distribute the config to all other sensors you 
have out there, and each config can be sensor-specific - individually 
crufted!   It _is_ an admin's goldmine, but only if you actually use it!!!

For SnortCenter Sensor Agent passwords and other Sensor-specific config, see 
it's config. Since I currently don't have sentinix compiled anywhere, I 
_think_ it's under /usr/local/snort/snortcenter/sensor/... not 100% sure 
though.

	Michel

On Wednesday 07 January 2004 16:22, M. Morgan wrote:
> Hmm that looks like it could be it. I've also been looking at the
> /etc/snort/snort.conf file,
>
> <snip>
> ####################################################################
> # Step #3: Configure output plugins
> #
> # Uncomment and configure the output plugins you decide to use.
> # General configuration for output plugins is of the form:
> #
> # output <name_of_plugin>: <configuration_options>
> #
> # alert_syslog: log alerts to syslog
> # ----------------------------------
> # Use one or more syslog facilities as arguments
> #
> # output alert_syslog: LOG_AUTH LOG_ALERT
>
> # log_tcpdump: log packets in binary tcpdump format
> # -------------------------------------------------
> # The only argument is the output file name.
> #
> # output log_tcpdump: tcpdump.log
>
> # database: log to a variety of databases
> # ---------------------------------------
> # See the README.database file for more information about configuring
> # and using this plugin.
> #
> # output database: log, mysql, user=root password=test dbname=db
> host=localhost # output database: alert, postgresql, user=snort
> dbname=snort
> # output database: log, unixodbc, user=snort dbname=snort
> # output database: log, mssql, dbname=snort user=snort password=test
> <snip>
>
> It looks like this line:
> output database: log, mysql, user=root password=test dbname=db
> host=localhost
>
> should read:
>
> output database: log, mysql, user=snort password=sentinix dbname=snort_db
> host=192.168.x.x
>
> or something along those lines.
>
> I'm referencing this document config settings:
> http://www.andrew.cmu.edu/~rdanyliw/snort/snortdb/snortdb_config.html
>
> Ill post back as this progresses.
>
> Thanks,
> Michael
>
>
> -----Original Message-----
> From: "Terkanian, Greg" <[email protected]>
> Sent: Jan 7, 2004 9:32 AM
> To: "M. Morgan" <[email protected]>,
> 	The SENTINIX Mailing List <[email protected]>
> Subject: RE: [sentinix-list] Output database
>
> I think the file you're looking for is
> /usr/local/snort/snortcenter/config.php
>
>
> -----Original Message-----
> From: sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org
> [mailto:sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org]On Behalf Of M. Morgan
> Sent: Wednesday, January 07, 2004 7:56 AM
> To: [email protected]
> Subject: [sentinix-list] Output database
>
>
> Hello all,
>  I'm trying to configure a remote sensor to log into a database on a
> seperate server.
>
>  Obviously I need to edit the output database config file but I cant seem
> to find it.
>
> Anyone have a quick and dirty how-to or the path to the file?
>
> here is the default line from snortcenter:
>
> output database: alert, mysql, user=snort password=sentinix dbname=snort
> host=localhost port=3306 sensor_name=[AUTO]
>
> I cant edit it in snort center though and need to reconfigure it to point
> to a different server.
>
> Many thanks!
>
> Michael
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix
>
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix

_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix

_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix