LinuxQuestions.org
Support LQ: Use code LQ3 and save $3 on Domain Registration
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 06-10-2004, 11:37 AM   #1
slizadel
LQ Newbie
 
Registered: Jun 2003
Distribution: RH9, Gentoo, Slack
Posts: 23

Rep: Reputation: 15
sysklogd sending logs out the wrong interface


I tried searching for an answer this and couldn't find anything, so here goes:

I am trying to setup syslogd (sysklogd to be exact) to send out snort logs to a remote IDS box for filtering, etc.

In /etc/syslog.con I added the following entry:
Code:
auth.*                 @XX.XX.XX.XX
where XX.XX.XX.XX is the remote machine I need to send the logs to.

On the local box I have two interfaces: eth1 with IP 10.10.10.1 This interface is not routable on our network, but it is setup as a spanned port on a managed switch to act as a passive sniffer. eth0 has IP 172.16.45.254, which is on our local admin LAN and has access to XX.XX.XX.XX.

I also added the following route:
Code:
route add XX.XX.XX.XX dev eth0
When I perform a traceroute XX.XX.XX.XX it does what I assume it should, it goes out 172.16.45.2 (the gateway for the admin lan). However, the remote machine is not receiving any syslogs. When I goto the console and pull up ethereal, performa a scan on eth1, all of the UDP syslog packets are being sent out that interface, instead of eth0, which it desperately needs to go out.

If anyone can help me out with this it would be greatly appreciated.

Update:
I decided to reboot the server. When everything came back up and snort was started, I took a look at ethereal. Now syslog packets from the local machine are being sent out both interfaces. If I need to post screenshots, please let me know.

Last edited by slizadel; 06-10-2004 at 11:59 AM.
 
Old 06-10-2004, 08:13 PM   #2
mritch
Member
 
Registered: Nov 2003
Location: austria
Distribution: debian
Posts: 667

Rep: Reputation: 30
try
"route add -host xx.xx.xx.xx eth0"
or send in a "route -n" + "ifconfig"

sl mritch.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Sending, receiving through the USB interface The_Nerd Programming 5 02-13-2005 03:49 AM
URGENT: how to get an ip address of sending interface in C dravya Linux - General 4 05-25-2004 04:32 PM
Sending Linksys logs to Linux box and IP tables xavierh Linux - Wireless Networking 1 03-05-2004 10:09 AM
Sending system logs without having exim installed? frank2 Linux - Networking 0 02-28-2004 03:20 PM
web interface for viewing logs clau_bolson Linux - Software 5 02-03-2004 08:19 AM


All times are GMT -5. The time now is 12:50 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration