2

I have installed snort and I want to use the swatch tool to send me an email when it detects something going wrong. I am using OSX and I followed the installation guide: http://www.snort.org/assets/188/Building_Snort_for_Mac_OS_X.pdf

In the .swatchrc file, I added these lines:

watchfor /Priority\: 1/i
mail addresses=USERNAME\@DOMAIN,subject=[SNORT] Priority 1 Alert

I put swatch as a daemon:

sudo swatch --daemon -c /etc/swatch/.swatchrc -t /var/log/snort/alert

and finally wrote a plist file in order to launch swatch at boot time. The problem is tht I don't receive anything when I connect to my os with an ssh connection from an other device. Could someone help ?

(Here's the plist file

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://
www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>Label</key>
        <string>net.sourceforge.swatch</string>
        <key>KeepAlive</key>
        <false/>
        <key>RunAtLoad</key>
        <true/>
        <key>ProgramArguments</key>
        <array>
                <string>/usr/local/bin/swatch</string>
                <string>--daemon</string>
                <string>-c</string>
                <string>/etc/swatch/.swatchrc</string>
                <string>-t</string>
                <string>/var/log/snort/alert</string>
Page 16 of 17        </array>
        <key>ServiceDescription</key>
        <string>Swatch 3.2.3</string>
</dict>
</plist>)
  • Can you confirm that swatch is running (ps)? Are you sure you triggered a priority 1 event? – schroeder Dec 19 '12 at 22:40
1

By default, swatch uses sendmail. Check to make sure sendmail can successfully send messages from a bash prompt. The second step to debugging this issue would be to actually read your /var/log/snort/alert file to see if any helpful information exists there. The solution to this issue is very likely a need to configure sendmail properly. There is the chance that it could be sitting in your queue, but not delivered, according to this user's case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.