Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have installed snort and I want to use the swatch tool to send me an email when it detects something going wrong. I am using OSX and I followed the installation guide: http://www.snort.org/assets/188/Building_Snort_for_Mac_OS_X.pdf

In the .swatchrc file, I added these lines:

watchfor /Priority\: 1/i
mail addresses=USERNAME\@DOMAIN,subject=[SNORT] Priority 1 Alert

I put swatch as a daemon:

sudo swatch --daemon -c /etc/swatch/.swatchrc -t /var/log/snort/alert

and finally wrote a plist file in order to launch swatch at boot time. The problem is tht I don't receive anything when I connect to my os with an ssh connection from an other device. Could someone help ?

(Here's the plist file

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://
www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>Label</key>
        <string>net.sourceforge.swatch</string>
        <key>KeepAlive</key>
        <false/>
        <key>RunAtLoad</key>
        <true/>
        <key>ProgramArguments</key>
        <array>
                <string>/usr/local/bin/swatch</string>
                <string>--daemon</string>
                <string>-c</string>
                <string>/etc/swatch/.swatchrc</string>
                <string>-t</string>
                <string>/var/log/snort/alert</string>
Page 16 of 17        </array>
        <key>ServiceDescription</key>
        <string>Swatch 3.2.3</string>
</dict>
</plist>)
share|improve this question
    
Can you confirm that swatch is running (ps)? Are you sure you triggered a priority 1 event? –  schroeder Dec 19 '12 at 22:40

1 Answer 1

up vote 1 down vote accepted

By default, swatch uses sendmail. Check to make sure sendmail can successfully send messages from a bash prompt. The second step to debugging this issue would be to actually read your /var/log/snort/alert file to see if any helpful information exists there. The solution to this issue is very likely a need to configure sendmail properly. There is the chance that it could be sitting in your queue, but not delivered, according to this user's case.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.