Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
[Snort-users] Snort and Syslog
6 views
Skip to first unread message
Phil Daws
Apr 4, 2013, 8:23:54 AM4/4/13
to
Hi,
When Snort starts it writes specific information to /var/log/messages eg.
Apr 4 12:01:40 fw1 snort[2951]: [ Port Based Pattern Matching Memory ]
Apr 4 12:01:40 fw1 snort[2951]: +- [ Aho-Corasick Summary ] -------------------------------------
Apr 4 12:01:40 fw1 snort[2951]: | Storage Format : Full-Q
Apr 4 12:01:40 fw1 snort[2951]: | Finite Automaton : DFA
Apr 4 12:01:40 fw1 snort[2951]: | Alphabet Size : 256 Chars
Apr 4 12:01:40 fw1 snort[2951]: | Sizeof State : Variable (1,2,4 bytes)
Apr 4 12:01:40 fw1 snort[2951]: | Instances : 294
Apr 4 12:01:40 fw1 snort[2951]: | 1 byte states : 275
Apr 4 12:01:40 fw1 snort[2951]: | 2 byte states : 19
Apr 4 12:01:40 fw1 snort[2951]: | 4 byte states : 0
Apr 4 12:01:40 fw1 snort[2951]: | Characters : 249637
How can I redirect those messages to a separate file as it plays havoc with OSSEC :) I have tried adding snort.none to rsyslog.conf for /var/log/messages and then added snort.* to direct too another file. That did not work :(
Any thoughts please ?
------------------------------------------------------------------------------
Minimize network downtime and maximize team effectiveness.
Reduce network management and security costs.Learn how to hire
the most talented Cisco Certified professionals. Visit the
Employer Resources Portal
http://www.cisco.com/web/learning/employer_resources/index.html
_______________________________________________
Snort-users mailing list
Snort...@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
Please visit http://blog.snort.org to stay current on all the latest Snort news!
When Snort starts it writes specific information to /var/log/messages eg.
Apr 4 12:01:40 fw1 snort[2951]: [ Port Based Pattern Matching Memory ]
Apr 4 12:01:40 fw1 snort[2951]: +- [ Aho-Corasick Summary ] -------------------------------------
Apr 4 12:01:40 fw1 snort[2951]: | Storage Format : Full-Q
Apr 4 12:01:40 fw1 snort[2951]: | Finite Automaton : DFA
Apr 4 12:01:40 fw1 snort[2951]: | Alphabet Size : 256 Chars
Apr 4 12:01:40 fw1 snort[2951]: | Sizeof State : Variable (1,2,4 bytes)
Apr 4 12:01:40 fw1 snort[2951]: | Instances : 294
Apr 4 12:01:40 fw1 snort[2951]: | 1 byte states : 275
Apr 4 12:01:40 fw1 snort[2951]: | 2 byte states : 19
Apr 4 12:01:40 fw1 snort[2951]: | 4 byte states : 0
Apr 4 12:01:40 fw1 snort[2951]: | Characters : 249637
How can I redirect those messages to a separate file as it plays havoc with OSSEC :) I have tried adding snort.none to rsyslog.conf for /var/log/messages and then added snort.* to direct too another file. That did not work :(
Any thoughts please ?
------------------------------------------------------------------------------
Minimize network downtime and maximize team effectiveness.
Reduce network management and security costs.Learn how to hire
the most talented Cisco Certified professionals. Visit the
Employer Resources Portal
http://www.cisco.com/web/learning/employer_resources/index.html
_______________________________________________
Snort-users mailing list
Snort...@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
Please visit http://blog.snort.org to stay current on all the latest Snort news!
Josh Bitto
Apr 4, 2013, 11:45:20 AM4/4/13
to
Your probably better off asking this question in rsyslog's mail group. I've gotten a lot of help from them.
Jeremy Hoel
Apr 4, 2013, 11:45:24 AM4/4/13
to
In OSSEC make a local rule to ignore the file and the process?
Or setup snort to not output to syslog..
and you might try running snort with the '-q' flag and see if it's quieter in the logs.
waldo kitty
Apr 4, 2013, 1:38:13 PM4/4/13
to
On 4/4/2013 10:45, Josh Bitto wrote:
> Your probably better off asking this question in rsyslog's mail group. I've gotten a lot of help from them.
or even better, report it to OSSEC so it can be fixed and not have the problems
> Your probably better off asking this question in rsyslog's mail group. I've gotten a lot of help from them.
any more... one has to wonder what all the other OSSEC using sites do since this
info is always posted... i just checked a live snort 2.8.something installation
and it posts this info, too... i know there are folks using OSSEC who used to
run snort 2.8...
> -----Original Message-----
> From: Phil Daws [mailto:ux...@splatnix.net]
> Sent: Thursday, April 04, 2013 5:24 AM
> To: snort...@lists.sourceforge.net
> Subject: [Snort-users] Snort and Syslog
>
Jeremy Hoel
Apr 4, 2013, 1:48:54 PM4/4/13
to
OSSEC has many rules, you can tweak them. It's not a False Positive.. it is something you might want to know, if you have no other tools telling you the data.
Doug Burks
Apr 4, 2013, 1:55:27 PM4/4/13
to
Hi Phil,
In Security Onion, we start Snort using the NSMnow scripts which
provide a function called process_start. This function starts the
process and writes the log to a dedicated log file (not syslog). In
the following code snippet, you can see that we're logging to $LOG,
which ends up being /var/log/nsm/HOSTNAME-INTERFACE/snortu-1.log.
# Start $IDS_LB_PROCS instances of Snort using pfring
load-balancing
for i in `seq 1 $IDS_LB_PROCS`; do
PID=$PROCESS_PID_DIR/$SENSOR/snortu-$i.pid
LOG=$PROCESS_LOG_DIR/$SENSOR/snortu-$i.log
PERFMON=$SENSOR_LOG_DIR/snort-$i.stats
UNI_DIR=$SENSOR_LOG_DIR/snort-$i
mkdir -p $UNI_DIR
chown $SENSOR_USER:$SENSOR_GROUP $UNI_DIR
[ -z "$SKIP_SNORT_ALERT" ] && process_start
"snort" "-c $SNORT_CONFIG -u $SENSOR_USER -g $SENSOR_GROUP -i
$SENSOR_INTERFACE_SHORT -F /etc/nsm/$SENSOR/bpf-ids.conf -l $UNI_DIR
--perfmon-file $PERFMON $SNORT_OPTIONS
" "$PID" "$LOG" "snort-$i (alert data)"
done
Hope that helps!
Thanks,
Doug
--
Doug Burks
http://securityonion.blogspot.com
In Security Onion, we start Snort using the NSMnow scripts which
provide a function called process_start. This function starts the
process and writes the log to a dedicated log file (not syslog). In
the following code snippet, you can see that we're logging to $LOG,
which ends up being /var/log/nsm/HOSTNAME-INTERFACE/snortu-1.log.
# Start $IDS_LB_PROCS instances of Snort using pfring
load-balancing
for i in `seq 1 $IDS_LB_PROCS`; do
PID=$PROCESS_PID_DIR/$SENSOR/snortu-$i.pid
LOG=$PROCESS_LOG_DIR/$SENSOR/snortu-$i.log
PERFMON=$SENSOR_LOG_DIR/snort-$i.stats
UNI_DIR=$SENSOR_LOG_DIR/snort-$i
mkdir -p $UNI_DIR
chown $SENSOR_USER:$SENSOR_GROUP $UNI_DIR
[ -z "$SKIP_SNORT_ALERT" ] && process_start
"snort" "-c $SNORT_CONFIG -u $SENSOR_USER -g $SENSOR_GROUP -i
$SENSOR_INTERFACE_SHORT -F /etc/nsm/$SENSOR/bpf-ids.conf -l $UNI_DIR
--perfmon-file $PERFMON $SNORT_OPTIONS
" "$PID" "$LOG" "snort-$i (alert data)"
done
Hope that helps!
Thanks,
Doug
Doug Burks
http://securityonion.blogspot.com
Phil Daws
Apr 4, 2013, 2:20:51 PM4/4/13
to
Hello Doug,
Very much appreciate the response. At the moment with a stock Snort install it starts with the command:
/usr/sbin/snort -d -D -i eth0 -u snort -g snort -c /etc/snort/snort.conf -l /var/log/snort/eth0
so looking at your start script one just needs to append the logfile to the end ?
Does that make sense ?
Very much appreciate the response. At the moment with a stock Snort install it starts with the command:
/usr/sbin/snort -d -D -i eth0 -u snort -g snort -c /etc/snort/snort.conf -l /var/log/snort/eth0
so looking at your start script one just needs to append the logfile to the end ?
Does that make sense ?
Doug Burks
Apr 4, 2013, 2:37:59 PM4/4/13
to
No, in my example $LOG is being passed to the process_start function
(not snort itself). If I remember correctly, process_start starts the
process *without* the -D (daemon) option, captures the process's
stdout and stderr, and writes them to $LOG.
Doug
(not snort itself). If I remember correctly, process_start starts the
process *without* the -D (daemon) option, captures the process's
stdout and stderr, and writes them to $LOG.
Doug
Phil Daws
Apr 4, 2013, 2:46:32 PM4/4/13
to
Darn, have to look at the code and see what its logging to. Thank you.
Phil Daws
Apr 4, 2013, 2:47:40 PM4/4/13
to
Thanks Josh, need to understand where Snort writes to. Is it a localX.* something or directly on the binary name.
----- Original Message -----
From: "Josh Bitto" <jbi...@onlineschool.ca>
To: "Phil Daws" <ux...@splatnix.net>, snort...@lists.sourceforge.net
Sent: Thursday, 4 April, 2013 4:45:20 PM
Subject: RE: Snort and Syslog
Your probably better off asking this question in rsyslog's mail group. I've gotten a lot of help from them.
From: "Josh Bitto" <jbi...@onlineschool.ca>
To: "Phil Daws" <ux...@splatnix.net>, snort...@lists.sourceforge.net
Sent: Thursday, 4 April, 2013 4:45:20 PM
Subject: RE: Snort and Syslog
Your probably better off asking this question in rsyslog's mail group. I've gotten a lot of help from them.
-----Original Message-----
From: Phil Daws [mailto:ux...@splatnix.net]
Sent: Thursday, April 04, 2013 5:24 AM
To: snort...@lists.sourceforge.net
Subject: [Snort-users] Snort and Syslog
From: Phil Daws [mailto:ux...@splatnix.net]
Sent: Thursday, April 04, 2013 5:24 AM
To: snort...@lists.sourceforge.net
Subject: [Snort-users] Snort and Syslog
Phil Daws
Apr 4, 2013, 2:49:42 PM4/4/13
to
Hi Jeremy,
How many rules would be require in OSSEC to suppress those entries! ;) The issue is how to make Snort write to a different file than syslog. I do not wish to suppress the Snort info just redirect to a different file so that I can pick the juicy bits out to monitor. Appreciate the input.
Thanks.
From: "Jeremy Hoel" <jth...@gmail.com>
To: "Phil Daws" <ux...@splatnix.net>
Cc: snort...@lists.sourceforge.net
Sent: Thursday, 4 April, 2013 4:45:24 PM
To: "Phil Daws" <ux...@splatnix.net>
Cc: snort...@lists.sourceforge.net
Sent: Thursday, 4 April, 2013 4:45:24 PM
Subject: Re: [Snort-users] Snort and Syslog
In OSSEC make a local rule to ignore the file and the process?
Or setup snort to not output to syslog..
and you might try running snort with the '-q' flag and see if it's quieter in the logs.
Lay, James
Apr 4, 2013, 2:54:33 PM4/4/13
to
Add:
output alert_fast: /dir/dir/snortalert.fast
to your snort.conf. It’s not syslog, but better.
James
Doug Burks
Apr 4, 2013, 10:53:27 PM4/4/13
to
Could you change your command line to something like the following
(removing the -D and redirecting stdout and stderr to the log file of
your choice)?
/usr/sbin/snort -d -i eth0 -u snort -g snort -c /etc/snort/snort.conf
-l /var/log/snort/eth0 >> /var/log/snort.log 2>&1
Doug
On Thu, Apr 4, 2013 at 2:46 PM, Phil Daws <ux...@splatnix.net> wrote:
> Darn, have to look at the code and see what its logging to. Thank you.
(removing the -D and redirecting stdout and stderr to the log file of
your choice)?
/usr/sbin/snort -d -i eth0 -u snort -g snort -c /etc/snort/snort.conf
-l /var/log/snort/eth0 >> /var/log/snort.log 2>&1
Doug
On Thu, Apr 4, 2013 at 2:46 PM, Phil Daws <ux...@splatnix.net> wrote:
> Darn, have to look at the code and see what its logging to. Thank you.
> ----- Original Message -----
> From: "Doug Burks" <doug....@gmail.com>
> To: "Phil Daws" <ux...@splatnix.net>
> Cc: snort...@lists.sourceforge.net
> Sent: Thursday, 4 April, 2013 7:37:59 PM
> Subject: Re: [Snort-users] Snort and Syslog
>
> From: "Doug Burks" <doug....@gmail.com>
> To: "Phil Daws" <ux...@splatnix.net>
> Cc: snort...@lists.sourceforge.net
> Sent: Thursday, 4 April, 2013 7:37:59 PM
> Subject: Re: [Snort-users] Snort and Syslog
>
> No, in my example $LOG is being passed to the process_start function
> (not snort itself). If I remember correctly, process_start starts the
> process *without* the -D (daemon) option, captures the process's
> stdout and stderr, and writes them to $LOG.
> Doug
>
> On Thu, Apr 4, 2013 at 2:20 PM, Phil Daws <ux...@splatnix.net> wrote:
>> Hello Doug,
>>
>> Very much appreciate the response. At the moment with a stock Snort install it starts with the command:
>>
>> /usr/sbin/snort -d -D -i eth0 -u snort -g snort -c /etc/snort/snort.conf -l /var/log/snort/eth0
>>
>> so looking at your start script one just needs to append the logfile to the end ?
>>
>> Does that make sense ?
>>
> (not snort itself). If I remember correctly, process_start starts the
> process *without* the -D (daemon) option, captures the process's
> stdout and stderr, and writes them to $LOG.
> Doug
>
> On Thu, Apr 4, 2013 at 2:20 PM, Phil Daws <ux...@splatnix.net> wrote:
>> Hello Doug,
>>
>> Very much appreciate the response. At the moment with a stock Snort install it starts with the command:
>>
>> /usr/sbin/snort -d -D -i eth0 -u snort -g snort -c /etc/snort/snort.conf -l /var/log/snort/eth0
>>
>> so looking at your start script one just needs to append the logfile to the end ?
>>
>> Does that make sense ?
>>
>> ----- Original Message -----
>> From: "Doug Burks" <doug....@gmail.com>
>> To: "Phil Daws" <ux...@splatnix.net>
>> Cc: snort...@lists.sourceforge.net
>> Sent: Thursday, 4 April, 2013 6:55:27 PM
>> Subject: Re: [Snort-users] Snort and Syslog
>>
>> From: "Doug Burks" <doug....@gmail.com>
>> To: "Phil Daws" <ux...@splatnix.net>
>> Cc: snort...@lists.sourceforge.net
>> Sent: Thursday, 4 April, 2013 6:55:27 PM
>> Subject: Re: [Snort-users] Snort and Syslog
>>
>> Hi Phil,
>>
>> In Security Onion, we start Snort using the NSMnow scripts which
>> provide a function called process_start. This function starts the
>> process and writes the log to a dedicated log file (not syslog). In
>> the following code snippet, you can see that we're logging to $LOG,
>> which ends up being /var/log/nsm/HOSTNAME-INTERFACE/snortu-1.log.
>>
>> # Start $IDS_LB_PROCS instances of Snort using pfring
>> load-balancing
>> for i in `seq 1 $IDS_LB_PROCS`; do
>> PID=$PROCESS_PID_DIR/$SENSOR/snortu-$i.pid
>> LOG=$PROCESS_LOG_DIR/$SENSOR/snortu-$i.log
>> PERFMON=$SENSOR_LOG_DIR/snort-$i.stats
>> UNI_DIR=$SENSOR_LOG_DIR/snort-$i
>> mkdir -p $UNI_DIR
>> chown $SENSOR_USER:$SENSOR_GROUP $UNI_DIR
>> [ -z "$SKIP_SNORT_ALERT" ] && process_start
>> "snort" "-c $SNORT_CONFIG -u $SENSOR_USER -g $SENSOR_GROUP -i
>> $SENSOR_INTERFACE_SHORT -F /etc/nsm/$SENSOR/bpf-ids.conf -l $UNI_DIR
>> --perfmon-file $PERFMON $SNORT_OPTIONS
>> " "$PID" "$LOG" "snort-$i (alert data)"
>> done
>>
>> Hope that helps!
>>
>> Thanks,
>> Doug
>>
>>
>>
>> In Security Onion, we start Snort using the NSMnow scripts which
>> provide a function called process_start. This function starts the
>> process and writes the log to a dedicated log file (not syslog). In
>> the following code snippet, you can see that we're logging to $LOG,
>> which ends up being /var/log/nsm/HOSTNAME-INTERFACE/snortu-1.log.
>>
>> # Start $IDS_LB_PROCS instances of Snort using pfring
>> load-balancing
>> for i in `seq 1 $IDS_LB_PROCS`; do
>> PID=$PROCESS_PID_DIR/$SENSOR/snortu-$i.pid
>> LOG=$PROCESS_LOG_DIR/$SENSOR/snortu-$i.log
>> PERFMON=$SENSOR_LOG_DIR/snort-$i.stats
>> UNI_DIR=$SENSOR_LOG_DIR/snort-$i
>> mkdir -p $UNI_DIR
>> chown $SENSOR_USER:$SENSOR_GROUP $UNI_DIR
>> [ -z "$SKIP_SNORT_ALERT" ] && process_start
>> "snort" "-c $SNORT_CONFIG -u $SENSOR_USER -g $SENSOR_GROUP -i
>> $SENSOR_INTERFACE_SHORT -F /etc/nsm/$SENSOR/bpf-ids.conf -l $UNI_DIR
>> --perfmon-file $PERFMON $SNORT_OPTIONS
>> " "$PID" "$LOG" "snort-$i (alert data)"
>> done
>>
>> Hope that helps!
>>
>> Thanks,
>> Doug
>>
>>
>> --
>> Doug Burks
>> http://securityonion.blogspot.com
>
>
>
> --
> Doug Burks
> http://securityonion.blogspot.com
--
Doug Burks
http://securityonion.blogspot.com
>> Doug Burks
>> http://securityonion.blogspot.com
>
>
>
> --
> Doug Burks
> http://securityonion.blogspot.com
--
Doug Burks
http://securityonion.blogspot.com
Jefferson, Shawn
Apr 5, 2013, 6:30:55 PM4/5/13
to
It’s actually pretty easy to suppress these in OSSEC. I have a couple rules, but the one I use for ignoring these syslog events that trigger OSSEC rule id 1002 (error somewhere in the system):
<rule id="101000" level="0">
<if_sid>1002</if_sid>
<program_name>^snort</program_name>
<match>Check for Bounce Attacks:|Bad Message Direction Alert:|Bad Payload Size Alert:|Bad Chk Sum:|Bad TTL:|Bad autodetects:|Bad handshakes:</match>
<description>Ignoring syslog events from snort startup</description>
</rule>
From: Phil Daws [mailto:ux...@splatnix.net]
Sent: Thursday, April 04, 2013 11:50 AM
To: Jeremy Hoel
Cc: snort...@lists.sourceforge.net
Subject: Re: [Snort-users] Snort and Syslog
Hi Jeremy,
How many rules would be require in OSSEC to suppress those entries! ;) The issue is how to make Snort write to a different file than syslog. I do not wish to suppress the Snort info just redirect to a different file so that I can pick the juicy bits out to monitor. Appreciate the input.
Thanks.
From: "Jeremy Hoel" <jth...@gmail.com>
To: "Phil Daws" <ux...@splatnix.net>
Cc: snort...@lists.sourceforge.net
Sent: Thursday, 4 April, 2013 4:45:24 PM
Subject: Re: [Snort-users] Snort and Syslog
In OSSEC make a local rule to ignore the file and the process?
Or setup snort to not output to syslog..
and you might try running snort with the '-q' flag and see if it's quieter in the logs.
0 new messages