I am starting snort with the startup file for the snort daemon in
/etc/init.d/snortd file
when I do a ps aux this is how snort is running:
snort 4044 0.0 2.8 63804 58508 ? Ss Feb22 1:20
/usr/sbin/snort -A fast -b -d -D -i eth0 -u snort -g snort -c
/etc/snort/snort.conf -l /var/log/snort
this is the syslog options I have configure in snort.conf:
grep syslog /etc/snort/snort.conf
# used to tune alerts from very active hosts such as syslog servers,
etc.
# alert_syslog: log alerts to syslog
# Use one or more syslog facilities as arguments. Win32 can also optionally
output alert_syslog: LOG_AUTH LOG_ALERT
# output alert_syslog: LOG_AUTH LOG_ALERT
# output alert_syslog: host=hostname, LOG_AUTH LOG_ALERT
# output alert_syslog: host=hostname:port, LOG_AUTH LOG_ALERT
# This example will create a rule type that will log to syslog and a mysql
output alert_syslog: LOG_AUTH LOG_ALERT
I am not running snort in a chroot enviroment
I am starting syslogd just by /etc/init.d/syslog restart
ps aux output for syslog:
ps aux |grep syslog
root 3966 0.0 0.0 3380 680 ? Ss Feb22 0:01 syslogd -m 0
Jim
On 2/24/06, James Lay <jlay@slave-tothe-box.net> wrote:
Jim,
How are you starting it?
What's in your snort.conf regarding syslog?
Are you running snort chroot?
How are you starting syslogd?
James
------------------------------
*From:* snort-users-admin@lists.sourceforge.net [mailto:
snort-users-admin@lists.sourceforge.net] *On Behalf Of *Jim B
*Sent:* Friday, February 24, 2006 8:58 AM
*To:* snort-users@lists.sourceforge.net
*Subject:* [Snort-users] snort not sending messages to syslog
I have configured snort to send messages to syslog but they are not being
sent to syslog, how can determine why the messages or alerts are not being
sent to syslog?
Jim
