1

I've been working on this for too long now. I'm sure the answer should be obvious, but...

Snort manual: http://www.snort.org/assets/125/snort_manual-2_8_5_1.pdf lists two logging outputs on pg 39 (pg 40 according to Acrobat Reader) as: "Unified Output" and "Log File Output" which I am guessing the former refers to the "unified" output mode... which makes me think the answer is "No, snort cannot output alerts for detected portscans to syslog."

Config file I've been using is:

alert tcp any 80 -> any any (msg:"TestTestTest"; content: "testtesttest"; sid:123) preprocessor sfportscan: proto  { all } \
                         memcap { 10000000 } \
                         scan_type { all } \
                         sense_level { high } \
                         logfile { pscan.log }

(yes, very basic I know).

A simple nmap triggers output to the pscan.log

Can anyone confirm this? Or point out how I do this?

1 Answer 1

1

Snort has a number of output options. That has historically included syslog, but even if it doesn't currently you can use barnyard to output to syslog (and I'd assume barnyard2 does too, but I haven't tested it).


Edit

I think I understand your confusion. Page 96 of the manual does detail to (alert) logging to syslog, however the logging you refer to is for logging packets, not alerts.

So yes, you can write alerts to syslog, you just can't log packets to syslog.

1
  • I was hoping not to have to complicate matters by involving other programs. I'd have thought if snort could write some of it's messages/warnings/alerts to syslog, it would be able to output all of them.
    – Jamie McNaught
    Mar 23, 2010 at 20:19

You must log in to answer this question.