Snort not send Alert to remote syslog server

yackluminoso · 03-28-2018, 10:09 AM

Snort run and log alert in file /var/log/snort/alert but the alert not are send to remote syslog server. I followed the instructions in the snort manual and rsyslog but nothing. Individually Snort and RSyslo work correctly but it seems that Snort can not pass the alerts to rsyslog. If I use logger everything works.

In rsyslog.conf ==> authpriv.alert @XXX.ZZZ.VVV.RRR:514 and the test

logger -p authpriv.alert "testXXX" work.

Snort log alert in /var/log/snort/alert but nothing arrives at the remote syslog server

JJJCR · 03-29-2018, 04:21 AM

Have you tried sending manually an email to your own email address?

Check whether it will work or not.

If it doesn't work then I guess you know what you should do and why snort does not work.

Good luck!!

Hint: if it doesn't work setup sendmail or whatever email client in your distro.