Message: 9 Date: Thu, 24 Feb 2005 18:40:45 +0530 From: Devdas Bhagat devdas@dvb.homelinux.org Subject: Re: [ILUG-BOM] Re snort trouble To: "GNU/Linux Users Group, Mumbai, India" linuxers@mm.ilug-bom.org.in Message-ID: 20050224184045.A1936@evita.devdas.geek Content-Type: text/plain; charset=us-ascii
On 24/02/05 00:56 -0800, Ninad Purohit wrote:
<snip> > i want snort to log alerts with priority local6 and > facility alert
Please prove that snort is not logging to local6.alert
then my syslog would redirect all syslogs with priority local6 (based on a rule i write in syslog.conf) to a listener ( netforensics agent)
Please show the relevant line from syslog.conf
the line from syslog is local6 @202.X.X.X i even tried logging it to a seperate file with local6 /var/log/snort.log
the line from snort.conf is output alert_syslog: LOG_LOCAL6 LOG_ALERT
but if i try file logging tail -f shows no logs comming in and i see no udp packets going to the destination host on port 514 in ethereal if i try forwarding it to a different host
===== ninad purohit ninadonline(at)yahoo(dot)co(dot)in have a nice day :-)
__________________________________ Do you Yahoo!? Yahoo! Mail - You care about security. So do we. http://promotions.yahoo.com/new_mail