How to Use Barnyard2 to log remote syslog??

tbaror

Hi All,

I trying to set Baryard2 in snort package

2.9.2.3 pkg v. 2.5.4 ,Pfsense 2.0.2-RELEASE (amd64)

to send alerts to remote syslog , i tried few syntax like

output alert_syslog: xxx.xxx.xxx.xxx:514

or

output alert_syslog: host=xxx.xxx.xxx.xxx

After setting Barnyard2 its shows running but nothing hit the syslog on other hand when i set firewall remote syslog i do see events arrives to syslog.
My question how is possible to get Barnyard2 log to syslog , did i missed somthing, is current Barnyard shipped with no possibility to syslog ?

Please advice
Thanks

Gloom

That would be because you have not setup an sql database to process the snort messages. Barnyard does not send to a syslog server it is a dedicated spooler for the snort unified2 output.
If you enable a remote syslog server and log everything then the snort alerts should end up on the remote server.

Gloom

Should have said you can download the schema for different database servers for Barnyard2 from here

https://github.com/firnsy/barnyard2/tree/master/schemas

tbaror

Ok , i figured out how to use syslog trough the Pfsense system syslog , its not perfect i preferred having unified2 format (full log) but OK.
Thanks