- [Instructor] In this lesson,
we'll configure snort to forward its log messages
to a syslog ng server.
Let's modify the snort configuration file.
Type CD,
space,
etc,
snort.
Press Enter.
Type LS.
Press Enter.
You can see the snort.conf file here.
Let's edit the file as a root user.
Type sudo
space,
nano,
space,
snort.conf.
Press Enter.
Let's do a search and look for syslog
Press Ctrl and W together to do the search.
Enter syslog as a search term.
Press Enter.
We've found the line we need.
Uncomment this line.
By uncommenting, what I mean is removing the pound sign.
The line says output alert_syslog,
log auth,
log alert.
Press Ctrl and X together to save the file.
Type Y, press Enter.
Now, snort is ready to send its log messages
to a syslog ng server.
However, there's one more step you should take.
When you run snort, you need to use a special option
which is dash lowercase S
to tell snort that now the log messages
are going to syslog ng.
Let's give it a try.
Type sudo,
space,
snort,
space,
dash lowercase S,
and then use the configuration file option
which is dash C,
space etc,
snort,
snort.conf.
We'll be monitoring the first network interface card,
which is ETH zero,
therefore type dash I,
space,
ETH zero.
Press Enter.
Snort is running.
Now, the log messages are not coming to the console.
It's not going to the snort log files either.
They're all being sent to syslog ng.