Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How can I log attacks separately using snort. I basically want to log attacks invoked from different files separately. Like if I have 2 files, ddos.rules and log.rules, then I want logs generated from ddos.rules in one file and logs generated from log.rules in another.

Is it possible, and if so how can I do it?

share|improve this question

3 Answers 3

The Bad News

Not directly, not in the way you want. You can specify multiple alert outputs, as described in the Section 2.6 of the manual. However, this will simply send the same alerts to multiple locations. You'll still have alerts from signatures imported from both ddos.rules and log.rules logged together.

The Good News

Fear not, we can make it work. What you'll have to do is create multiple config files and have each log separately. Depending on exactly how you want to split up the traffic there are a couple of ways you can go.

MultiConfig

Snort has a mechanism built-in to allow for processing different packet streams against different config files. This can be useful if you segment your applications based on network or VLAN. That is, all mail apps are on one VLAN, web servers on another, etc. The full details are provided in Section 2.10 of the manual, but the most relevant bits to understand are that it's dependent on VLAN or network, and there can be no duplicates. Meaning this is a valid configuration,

config binding: /etc/snort/snort.conf-ddos net 192.168.100.0/24
config binding: /etc/snort/snort.conf-log net 192.168.200.0/24

but this is not.

config binding: /etc/snort/snort.conf-ddos net 192.168.100.0/24
config binding: /etc/snort/snort.conf-log net 192.168.100.0/24

To use this feature in your situation you would have to run ddos.rules against one set of hosts and log.rules against another. I doubt you want to take this approach.

Multiple Instances

To date snort is single threaded so when processing is intense enough to utilize one complete processor it will begin dropping packets. Thanks to this you will often find snort sensors with several versions of snort running. Generally this works by using something called PF_RING, which is like a packet load balancer, or by chopping up your network space and running one version of snort per block. So one instance of snortd monitoring 192.168.1.0/25 and another watching 192.168.1.128/25. In most cases each process will use the same config file but just only watch certain addresses.

We can take that approach and turn it on it's head a bit to work in your situation. Let's create two config files and set the relevant portions thusly.

/etc/snort/snort.conf-ddos

output alert_syslog: LOG_LOCAL0 LOG_ALERT
include $RULE_PATH/ddos.rules

/etc/snort/snort.conf-log

output alert_syslog: LOG_LOCAL1 LOG_ALERT
include $RULE_PATH/log.rules

Then we set up your syslog engine, restarting it after making the change of course.

local0.alert       /var/log/snort/alert-ddos.log
local1.alert       /var/log/snort/alert-log.log

Now when you run snort you do it twice, each using the -c option. The first time we'll use -c /etc/snort/snort.conf-ddos and the second with -c /etc/snort/snort.conf-log.

Now you should have two instances of snortd running, one only with the ddos.rules signatures and logging to LOCAL0 and one with the log.rules signatures and logging to LOCAL1. As long as syslog is behaving you should have your alerts logging separately with no co-mingling.

share|improve this answer

Snort certainly supports multiple, simultaneous log targets. I think in your desired use case the possibility may hinge on your rulesets and how you want them to log. I have never done it this way and don't have a need/desire to.

Have a look at http://manual.snort.org/node21.html. This link details the Snort output options.

share|improve this answer

I do not really like the idea of running multiple instances of snort. Note that as far as I remember snort is not a multi-threading detection engine. I think this solution will create a performance issue assume you have n numbers of rules set. Is this mean you will run n number of snort instances?

So, how can you do it? you need to use a log parser. So basically you let snort log all the alerts in a single log file. This file can be for example a ".csv" then using a simple log parser you can parse the file and create separate log files for each rule-set.

Is there any well know log parser tool that can parse snort logs?, Yes of course, If you are using windows then you can use Log Parser 2.2.

If you are using other platform for example Linux. You can simply use python to write a small script that parse the log. See this post for a sample code.

Currently I am working on an IDS alerts correlation system. I can give you a small python script (part of my system) that do exactly what you want if you like?

share|improve this answer
    
Multi-threaded is the primary feature that's been consistently stated, "Coming in 3.0". However they keep backporting 3.0 planned features into the 2.9 series, just not that one. Multiple instances is, unfortunately, still the only way to spread out load beyond one core. –  Scott Pack Apr 7 at 12:13
    
Thank you for the information. It is good to know that multi-threading is finally coming to SNORT. Yes, I know that the only way right now for load balancing is to run multiple instances. But if I only want to separate the alerts into different files based on some criteria (e.g src IP, signature id, etc). I will not run multiple instances just use some script to process the log and separate the alerts as desired. What do you think the problem with this approach? –  Abu Ubaidah Apr 7 at 15:49
    
Oh sure, it's an available feature but it seems pretty unnecessary for his use case. The most correct method would be to do post processing in your log aggregation system, however that may not necessarily be applicable and preprocessing may be the most logical solution. I wouldn't hold your breath for multithreaded, though. It won't happen until v3 which has effectively been "any day now" for how many years? –  Scott Pack Apr 7 at 15:56
    
@Abu Ubaida - this comment is sort of a side conversation regarding multiple instances. In some cases this is necessary. In my work, all of the data centers pass way more traffic than what a single Snort instance can handle. So the setups include multiple spans to multiple Snort instances to support all of the traffic that is fed to us. In may cases this means sixteen instances. –  user1801810 Apr 10 at 15:35
1  
@Abu Ubaida - oh yes, I agree with you entirely. Cheers. –  user1801810 Apr 11 at 21:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.