root@LinuxTest:~# snort -V ,,_ -*> Snort! <*- o" )~ Version 2.9.7.0 GRE (Build 149) '''' By Martin Roesch & The Snort Team: http://www.snort.org/contact#team Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using libpcap version 1.8.1 Using PCRE version: 8.39 2016-06-14 Using ZLIB version: 1.2.8 root@LinuxTest:~# cat /etc/rsyslog.conf|grep '*.*'|grep 514|grep -v '#' *.* @192.168.0.1:514 root@LinuxTest:~# cat /etc/snort/snort_syslog.conf|grep syslog|grep -v '#' output alert_syslog: host=192.168.0.1:514, LOG_LOCAL1 LOG_ALERT root@LinuxTest:~# ps -aef|grep snort root 8709 1 0 01:59 ? 00:00:02 /usr/sbin/snort -c /etc/snort/snort_syslog.conf -i eth0 -A full -D -s
P.S.: In this case, 192.168.0.1 is the remote syslogd server. Moreover, after everything above is set, rebooting the system is a must. Otherwise, the rsyslogd may not function properly.
No comments:
Post a Comment