Tag Info

New answers tagged


The issue was that I used tcp() and udp() source driver [BSD format] instead of syslog() [IETF format]. It's working now.


I've pieced together enough documentation to get something working. The solution involves telling snort to log to syslog, and then setting up syslog-ng to trigger on the snort syslog traffic to run the given shellscript. Having snort spooling to disk, or running scripts, isn't ideal for high traffic loads so be advised. If you configure snort to only alert ...


Take a look at elasticsearch + logstash + kibana Logstash can parse your log files and extract information from them using filters. It can store them in Elasticsearch, which you can query via Kibana. Have a look at the videos on their site to get a feel about what it can do.


Your first option could be done via loghost (basically your option 2) You can send your syslog message via udp to $logserver . Then you would split the logs there based on server and have the "exact" timestamps of the logs you did send. The renaming of logs would be not necessary on the nginx servers, other than the usual logrotate you most likely need with ...

Top 50 recent answers are included