<html><body><div style="font-family: Andale Mono; font-size: 12pt; color: #000000"><div>Hi Leonard,</div><div><br data-mce-bogus="1"></div><div>I use a custom script to read fast.log and sendmail event by event. I choose work that way because we are a CSIRT, so, all incident handler is by email.</div><div><br data-mce-bogus="1"></div><div>Works fine.</div><div><br data-mce-bogus="1"></div><div>Regards,</div><div><br></div><div data-marker="__SIG_PRE__">-----------------------------------------------<br>Alan Santos<br>Analista de Segurança<br>Centro de Atendimento a Incidentes de Segurança (CAIS)<br>Rede Nacional de Ensino e Pesquisa (RNP)<br>(19) 3787-3314 | alan.santos@rnp.br</div><br><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>De: </b>"Leonard Jacobs" <ljacobs@netsecuris.com><br><b>Para: </b>"Saxena, Samiksha" <samiksha.saxena@verizon.com>, "oisf-users" <oisf-users@lists.openinfosecfoundation.org><br><b>Enviadas: </b>Segunda-feira, 27 de julho de 2015 17:39:28<br><b>Assunto: </b>Re: [Oisf-users] Suricata Logs<br></div><br><div data-marker="__QUOTED_TEXT__"><style><!--
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><div class="WordSection1"><p class="MsoNormal"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;" data-mce-style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;">https://redmine.openinfosecfoundation.org/projects/suricata/wiki/_Logstash_Kibana_and_Suricata_JSON_output</span></p><p class="MsoNormal"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;" data-mce-style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;"> </span></p><p class="MsoNormal"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;" data-mce-style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;">https://github.com/pevma/Suricata-Logstash-Templates</span></p><p class="MsoNormal"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;" data-mce-style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;"> </span></p><p class="MsoNormal"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;" data-mce-style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;">Or if you program and you want a customized application, you can write code to enter fast.log into a database then write a front end to the database to display the data.</span></p><p class="MsoNormal"><span style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;" data-mce-style="font-size: 11.0pt; font-family: 'Calibri','sans-serif'; color: #1f497d;"> </span></p><div><div style="border: none; border-top: solid #B5C4DF 1.0pt; padding: 3.0pt 0in 0in 0in;" data-mce-style="border: none; border-top: solid #B5C4DF 1.0pt; padding: 3.0pt 0in 0in 0in;"><p class="MsoNormal"><b><span style="font-size: 10.0pt; font-family: 'Tahoma','sans-serif';" data-mce-style="font-size: 10.0pt; font-family: 'Tahoma','sans-serif';">From:</span></b><span style="font-size: 10.0pt; font-family: 'Tahoma','sans-serif';" data-mce-style="font-size: 10.0pt; font-family: 'Tahoma','sans-serif';"> oisf-users-bounces@lists.openinfosecfoundation.org [mailto:oisf-users-bounces@lists.openinfosecfoundation.org] <b>On Behalf Of </b>Saxena, Samiksha<br><b>Sent:</b> Monday, July 27, 2015 12:54 PM<br><b>To:</b> oisf-users<br><b>Subject:</b> [Oisf-users] Suricata Logs</span></p></div></div><p class="MsoNormal"> </p><div><p class="MsoNormal"><span style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;" data-mce-style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;">Hi, </span></p></div><div><p class="MsoNormal"><span style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;" data-mce-style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;"> </span></p></div><div><p class="MsoNormal"><span style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;" data-mce-style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;">I will have more than 20 Suricata engines, where each suricata engine will generate logs based on rules. I want to collect all the logs at one common place from each suricata engine. How should I achieve this?</span></p></div><div><p class="MsoNormal"><span style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;" data-mce-style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;">Also, what is the value of the logs files and how often the logs are generated?</span></p></div><div><p class="MsoNormal"><span style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;" data-mce-style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;"> </span></p></div><div><p class="MsoNormal"><span style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;" data-mce-style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;"> </span></p></div><div><p class="MsoNormal"><span style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;" data-mce-style="font-size: 10.5pt; font-family: 'Calibri','sans-serif'; color: black;">Thanks</span></p></div></div><br>_______________________________________________<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>Suricata User Conference November 4 & 5 in Barcelona: http://oisfevents.net<br></div></div></body></html>