<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div style="font-family: Consolas; font-size: medium;">Hi All,</div>
<div style="font-family: Consolas; font-size: medium;"><br>
</div>
<div style="font-family: Consolas; font-size: medium;">I’m trying to get snort and/or barnyard2 to send full alerts to a remote</div>
<div style="font-family: Consolas; font-size: medium;">syslog server for analysis with thinks like splunk, etc. I think I may have</div>
<div style="font-family: Consolas; font-size: medium;">found a bug in barnyard2, but I wanted to put it out to the list to see if</div>
<div style="font-family: Consolas; font-size: medium;">anyone else is successful at this. I’m trying to send it to LOCAL3 so that</div>
<div style="font-family: Consolas; font-size: medium;">I can parse off the logs into its own file in rsylog.conf.</div>
<div style="font-family: Consolas; font-size: medium;"><br>
</div>
<div style="font-family: Consolas; font-size: medium;">No matter what I try, I will only get ‘fast’ alert data in /var/log/messages</div>
<div style="font-family: Consolas; font-size: medium;">on my rsyslog server (not the local3.* entry as expected). The</div>
<div style="font-family: Consolas; font-size: medium;">"operation_mode complete” switch is supposed to set the alerts to full</div>
<div style="font-family: Consolas; font-size: medium;">logging, but it doesn’t work remote or locally.</div>
<div style="font-family: Consolas; font-size: medium;"><br>
</div>
<div style="font-family: Consolas; font-size: medium;">In barnyard2 config:</div>
<div style="font-family: Consolas; font-size: medium;"><br>
</div>
<div style="font-family: Consolas; font-size: medium;">output alert_syslog_full: sensor_name snortSensor, server x.x.x.x, protocol</div>
<div style="font-family: Consolas; font-size: medium;">udp, port 514, operation_mode complete, log_priority LOG_ALERT, log_facility</div>
<div style="font-family: Consolas; font-size: medium;">LOG_LOCAL3</div>
<div style="font-family: Consolas; font-size: medium;"><br>
</div>
<div style="font-family: Consolas; font-size: medium;">/etc/rsylog.conf entry:</div>
<div style="font-family: Consolas; font-size: medium;"><br>
</div>
<div style="font-family: Consolas; font-size: medium;">local3.*</div>
<div style="font-family: Consolas; font-size: medium;">/var/log/snortsyslog/snort.log</div>
<div style="font-family: Consolas; font-size: medium;"><br>
</div>
<div style="font-family: Consolas; font-size: medium;"><br>
</div>
<div style="font-family: Consolas; font-size: medium;">Output from messages after barnyard2 startup:</div>
<div style="font-family: Consolas; font-size: medium;"><br>
</div>
<div style="font-family: Consolas; font-size: medium;">Oct 1 12:46:50 sensor barnyard2: Barnyard2 spooler: Event cache size set to</div>
<div style="font-family: Consolas; font-size: medium;">[2048]</div>
<div style="font-family: Consolas; font-size: medium;">Oct 1 12:46:50 sensor barnyard2: Log directory = /var/log/snort</div>
<div style="font-family: Consolas; font-size: medium;">Oct 1 12:46:50 sensor barnyard2: INFO database: Defaulting</div>
<div style="font-family: Consolas; font-size: medium;">Reconnect/Transaction Error limit to 10</div>
<div style="font-family: Consolas; font-size: medium;">Oct 1 12:46:50 sensor barnyard2: INFO database: Defaulting Reconnect sleep</div>
<div style="font-family: Consolas; font-size: medium;">time to 5 second</div>
<div style="font-family: Consolas; font-size: medium;">Oct 1 12:46:50 sensor barnyard2: using operation_mode: complete</div>
<div style="font-family: Consolas; font-size: medium;">Oct 1 12:46:50 sensor barnyard2: Using default delimiters for syslog</div>
<div style="font-family: Consolas; font-size: medium;">messages "|"</div>
<div style="font-family: Consolas; font-size: medium;">Oct 1 12:46:50 sensor barnyard2: Using default field separators for syslog</div>
<div style="font-family: Consolas; font-size: medium;">messages " "</div>
<div style="font-family: Consolas; font-size: medium;">Oct 1 12:46:50 sensor barnyard2: spo_syslog_full config:</div>
<div style="font-family: Consolas; font-size: medium;">Oct 1 12:46:50 sensor barnyard2: #011Detail Level: Fast</div>
<div style="font-family: Consolas; font-size: medium;">Oct 1 12:46:50 sensor barnyard2: #011Syslog Server: x.x.x.x:514</div>
<div style="font-family: Consolas; font-size: medium;">Oct 1 12:46:50 sensor barnyard2: #011Reporting Protocol: udp</div>
<div style="font-family: Consolas; font-size: medium;">Oct 1 12:46:50 sensor barnyard2: Initializing daemon mode</div>
<div style="font-family: Consolas; font-size: medium;">Oct 1 12:46:50 sensor barnyard2: Daemon parent exiting</div>
<div style="font-family: Consolas; font-size: medium;">Oct 1 12:46:50 sensor barnyard2: Daemon initialized, signaled parent pid:</div>
<div style="font-family: Consolas; font-size: medium;">13339</div>
<div style="font-family: Consolas; font-size: medium;">Oct 1 12:46:50 sensor barnyard2: PID path stat checked out ok, PID path set</div>
<div style="font-family: Consolas; font-size: medium;">to /var/run/</div>
<div style="font-family: Consolas; font-size: medium;">Oct 1 12:46:50 sensor barnyard2: Writing PID "13340" to file</div>
<div style="font-family: Consolas; font-size: medium;">"/var/run//barnyard2_eth1.pid"</div>
<div style="font-family: Consolas; font-size: medium;"><br>
</div>
<div style="font-family: Consolas; font-size: medium;"><br>
</div>
<div style="font-family: Consolas; font-size: medium;">Sample syslog entry:</div>
<div style="font-family: Consolas; font-size: medium;"><br>
</div>
<div style="font-family: Consolas; font-size: medium;">Oct 1 11:59:51 sensor | [SNORTIDS[ALERT]: [sensor-eth1] ] || 2014-10-01</div>
<div style="font-family: Consolas; font-size: medium;">11:59:54.967+-04 1 [1:1000022:1] LOCAL-RULE Possible login.aspx Brute Force</div>
<div style="font-family: Consolas; font-size: medium;">Account Access || web-application-attack || 6 x.x.x.x y.y.y.y || 20175 80 ||</div>
<div style="font-family: Consolas; font-size: medium;">#012 |</div>
<div style="font-family: Consolas; font-size: medium;"><br>
</div>
<div style="font-family: Consolas; font-size: medium;"><br>
</div>
<div style="font-family: Consolas; font-size: medium;">The output in unified2/mysql is the full payload and you can see the full</div>
<div style="font-family: Consolas; font-size: medium;">HTTP POST.</div>
<div style="font-family: Consolas; font-size: medium;"><br>
</div>
<div style="font-family: Consolas; font-size: medium;">Am I missing something?</div>
<div style="font-family: Consolas; font-size: medium;"><br>
</div>
<div style="font-family: Consolas; font-size: medium;">Thanks in advance,</div>
<div style="font-family: Consolas; font-size: medium;"><br>
</div>
<div style="font-family: Consolas; font-size: medium;">John.</div>
</div>
</body>
</html>