[Day 2] 5. SYSLOG Server

What is a SYSLOG Server?

A SYSLOG server is a centralized system that collects, stores, and manages log messages from various devices, servers, and applications on a network. It simplifies monitoring by aggregating logs in one place, making it easier to analyze and troubleshoot issues.

Problem Statement

Monitoring network traffic manually on individual systems is inefficient and inconvenient.
Redirecting log traffic to a centralized location allows better management and analysis of logs.
The solution is to use a SYSLOG server for centralized logging.

Using Kiwi SYSLOG Server

Why Kiwi SYSLOG Server?
- Kiwi SYSLOG Server allows centralized collection of logs, including those from Snort.
- Note: This is a trial version (14 days), so avoid installing it on the base machine.
Installation Steps:
- Switch off the firewall of the virtual machine.
- Install Kiwi SYSLOG Server in the virtual machine (VM).
- During installation, choose "Application" mode (not as a service).
- Proceed with the installation: Next → Next → Finish.
Testing the SYSLOG Server:
- Launch the Kiwi SYSLOG Server.
- Press CTRL + T to test the functionality of the server.
- Ensure that both the base machine and the SYSLOG server VM can ping each other.

Configuring Snort to Use SYSLOG Server

Locate the SYSLOG Step in
```
snort.conf
```
:
- ```
snort.conf
```
  is divided into sections (called steps).
- In Step 6, locate the line starting with
```
#syslog
```
  .

Add the Following Line (below the

#syslog

line):

text
output alert_syslog: host=<SYSLOG_IP>:514, LOG_AUTH LOG_ALERT

Replace
```
<SYSLOG_IP>
```
with the IP address of the SYSLOG server.
Note: SYSLOG runs on port 514 by default.

Save the Configuration.

Running Snort to Send Logs to SYSLOG Server

Use the following command to start Snort and redirect logs to the SYSLOG server:

shell
snort -i 4 -c C:\Snort\etc\snort.conf -l C:\Snort\log -s

```
-s
```
: Specifies that the output will be sent to the SYSLOG server.

Summary

A SYSLOG server allows centralized logging for easier traffic analysis and troubleshooting.
Kiwi SYSLOG Server is used for this purpose, installed on a VM.
Snort can be configured to send its alerts directly to the SYSLOG server using the
```
output alert_syslog
```
directive in
```
snort.conf
```
.