@MichaelB:
Upgraded to the latest Snort version.
Now it seems like the full_syslog_full is working, but ONLY if you send it to a remote syslog server. So you can't send full events to a local syslog. I just modified my grok rules to be able to catch syslog events forwarded from the local system to a remote syslog (via status => system logs), but that format is different when you send them directly from snort to a remote syslog.
I think it should work, I'll modify the grok rules later today. However, to improve consistency with other logs forwarded via the system, perhaps it is a good idea to also allow "local full syslog complete" .
In other words, now I have:
output log_syslog_full: sensor_name snort.WAN, server 192.168.2.2, protocol udp, port 514, operation_mode complete, payload_encoding hex, log_facility LOG_USER, log_priority LOG_INFO
Which gives a different format on my remote syslog server then when using the following in combination with remote logging via the status => system logs setting:
output log_syslog_full: sensor_name snort.WAN, operation_mode complete, payload_encoding hex, log_facility LOG_USER, log_priority LOG_INFO
Kr,
Michael
I did in fact code it so that full packet capture only works to a remote syslog server. It is not a good idea to fill up your local firewall system log with full packet captures, so I elected to not make that available.
Bill
