- [Instructor] Let's install syslog-ng
on our Ubuntu router.
Type sudo apt-get install syslog-ng ,
press ENTER.
Type Y and press ENTER.
Let's check if our syslog-ng service is up and running,
type systemctl status syslog-ng,
press ENTER,
it's active.
Press Q to exit.
The syslog-ng service is running on our Ubuntu router
which is the same host where Snort is installed.
We'll forward Snort log messages
through the syslog-ng log service,
then we'll forward the same log messages
to a centralized log server.
The centralized log server solution we'll be using is Kiwi.
Let's go to the syslog-ng configuration file
by typing cd /etc/syslog-ng/,
press ENTER.
Type ls, press ENTER
and you can see that syslog-ng.conf file here.
Type sudo nano syslog-ng.conf,
press ENTER.
Let's do a search and look for the term destination,
press CTRL+W together,
type destination,
press ENTER.
We'll create our own destination here to define
the destination for the Snort log messages being forwarded
to our centralized log server, Kiwi.
Type destination,
and then df ,standing for destination facility,
underscore snort underscore remote.
We'll be using UDP instead of TCP to send our log messages
because we don't really need a reliable connection.
UDP stands for User Datagram Protocol.
Type the IP of the target log server,
which is 10.0.0.5,
udp 10.0.0.5 in double quotes,
and then the port number,
port which is 514 for logging,
close parenthesis, semi-colon,
our destination is now defined.
The next step is to define our own log function
so that we can forward our messages
to the third party remote log server.
Let's go down to the end of the file,
type log,
we first define what the source is,
type source(s_src);.
As you can see here, the syslog-ng.conf file defines,
s_src, as all the messages coming from
the local host including the messages originating
from our Snort program.
Next we'll be using a filter, a predefined one here
which is f_auth,
so type filter(f_auth);.
Do you remember that one of the log facility types used
by Snort was facility_auth.
The last step is to specify the destination,
we defined all year.
Type destination df_snort_remote.
We're now done with editing our syslog-ng.conf file.
Let's save it by pressing CTRL and X keys together.
Type Y and let's accept the current file name,
by pressing ENTER.
Let's restart syslog-ng
so that we get to use the updated configuration information.
Type sudo systemctl restart syslog-ng,
press ENTER.
Our syslog-ng server has just restarted
without any problems.
What this means is that from now on,
all the Snort log messages are being forwarded
to our remote centralized log server.