Logs of snort to Syslog
-
The logs that snort is generating for me appear directly in my pfsense but when I send them to syslogs, the snort logs are not sent, but the other firewall logs are sent, what should I do for this to work?
-
Do you have the option to enable syslog logging enabled for the interface? You must specifically enable the logging of alerts to syslog. But be aware that the FreeBSD syslog daemon truncates syslog entries after a certain message length. I don't recall off the top of my head what that value is, but it does result in some of the alert messages being cut off in the syslog record.
Later Edit: went back and found the message length. It was 480 bytes for IPv4 and 1180 for IPv6. This turned out to be a bug in that the RFC behavior was misunderstood or else not implemented correctly. Here is the FreeBSD bug tracker: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=241937. Not sure what the current status of this bug is within the pfSense kernel code.
