Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been working on this for too long now. I'm sure the answer should be obvious, but...

Snort manual: http://www.snort.org/assets/125/snort_manual-2_8_5_1.pdf lists two logging outputs on pg 39 (pg 40 according to Acrobat Reader) as: "Unified Output" and "Log File Output" which I am guessing the former refers to the "unified" output mode... which makes me think the answer is "No, snort cannot output alerts for detected portscans to syslog."

Config file I've been using is:

alert tcp any 80 -> any any (msg:"TestTestTest"; content: "testtesttest"; sid:123) preprocessor sfportscan: proto  { all } \
                         memcap { 10000000 } \
                         scan_type { all } \
                         sense_level { high } \
                         logfile { pscan.log }

(yes, very basic I know).

A simple nmap triggers output to the pscan.log

Can anyone confirm this? Or point out how I do this?

share|improve this question

1 Answer 1

Snort has a number of output options. That has historically included syslog, but even if it doesn't currently you can use barnyard to output to syslog (and I'd assume barnyard2 does too, but I haven't tested it).


Edit

I think I understand your confusion. Page 96 of the manual does detail to (alert) logging to syslog, however the logging you refer to is for logging packets, not alerts.

So yes, you can write alerts to syslog, you just can't log packets to syslog.

share|improve this answer
    
I was hoping not to have to complicate matters by involving other programs. I'd have thought if snort could write some of it's messages/warnings/alerts to syslog, it would be able to output all of them. –  Jamie McNaught Mar 23 '10 at 20:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.