LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 08-28-2014, 01:48 PM   #1
seabro
LQ Newbie
 
Registered: Jan 2010
Posts: 26

Rep: Reputation: 0
Trying to understand what rsyslogd does


Hi,

I have installed Snort and Splunk on the same server.

Splunk is receiving syslog messages on UDP 514 from my router.

However, I am having problems getting Snort to send anything to Splunk.

In the guides I have seen, it entails enabling Rsyslog. What does that do? They are both on the same machine, can't Snort just send to Splunk? Why the third party?

This syslog config for Snort is quite simple:
# syslog
# output alert_syslog: LOG_AUTH LOG_ALERT
output alert_syslog: host=192.168.0.251:514, LOG_AUTH LOG_ALERT

But the syslogs don't arrive at Splunk.

If I do load up rsyslog, Splunk stops receiving syslogs from my router.. I guess there is a conflict with 2 apps trying to listen on the same port.

It is possible to get rsyslog to work on TCP but I honestly don't know if it is sending or receiving.

Confused. Any explanation of how the puzzle fits together would be helpful.

Thanks!
seabro
 
Old 08-29-2014, 08:01 AM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985
if splunk is on the same box, then you'd just read snorts default local log files in most cases. rsyslog is (from what I understand) being used to bridge between locally logged syslog messages (through a syslog socket, not a network connection) to the generic network world. It does seem that snort can log directly though, so no, rsyslog shouldn't be required.
 
Old 08-29-2014, 08:21 AM   #3
szboardstretcher
Senior Member
 
Registered: Aug 2006
Location: Detroit, MI
Distribution: GNU/Linux systemd
Posts: 4,278

Rep: Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694
Splunk is paid software, and will delete anything after 500MB of logs IIRC. So don't use it in production unless you pay for it.

Graylog2 and ELK are free alternatives to Splunk, if you are interested.

Last edited by szboardstretcher; 08-29-2014 at 08:56 AM.
 
Old 08-29-2014, 01:40 PM   #4
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985
wow, that's some odd, and unsolicited, hate for an excellent piece of software.
 
Old 08-29-2014, 01:52 PM   #5
szboardstretcher
Senior Member
 
Registered: Aug 2006
Location: Detroit, MI
Distribution: GNU/Linux systemd
Posts: 4,278

Rep: Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694
Quote:
unsolicited
This is a forum. The idea is to chime in if you have something constructive to say. I don't have to be invited to a conversation.

Quote:
hate for an excellent piece of software
I made no mention of 'hating' splunk.

Quote:
hate for an excellent piece of software
I would appreciate it if you didn't attempt to put words in my mouth.

Last edited by szboardstretcher; 08-29-2014 at 02:01 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
rsyslogd crashes while running as rsyslogd(rsyslogd -M /lib/rsyslog running well) vipul prajapati Linux - Server 1 03-22-2014 03:02 AM
SFTP and rsyslogd not actually logging. Config help? arashi256 Linux - Server 3 04-13-2012 07:15 AM
Rsyslogd start problem parmeshwer Linux - Software 1 02-03-2010 03:58 PM
rsyslogd configuration wayloud Linux - Server 2 10-14-2008 02:33 AM
rsyslogd -- Signals and other stuff dave247 Fedora 12 02-20-2008 07:19 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 02:16 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration