diff -ruN barnyard-0.2.0/src/output-plugins/op_alert_syslog2.c barnyard-0.2.0-cmg/src/output-plugins/op_alert_syslog2.c --- barnyard-0.2.0/src/output-plugins/op_alert_syslog2.c 2008-01-10 15:50:04.000000000 -0600 +++ barnyard-0.2.0-cmg/src/output-plugins/op_alert_syslog2.c 2007-12-17 11:12:10.000000000 -0600 @@ -350,6 +350,14 @@ (record->dip & 0x00ff0000) >> 16, (record->dip & 0x0000ff00) >> 8, record->dip & 0x000000ff); +/* + * Example log line from Snort: + * May 10 09:06:30 capone snort[25872]: [1:6000022:1] Sloppy Rule #6000022 \ + * [Classification: Sloppy Rule Class] [Priority: 90]: {TCP} \ + * 63.85.194.187:34029 -> 63.85.194.181:22 + * + */ + switch(record->protocol) { case IPPROTO_TCP: @@ -357,33 +365,33 @@ length = snprintf(op_data->message_buffer + op_data->header_length, MESSAGE_LENGTH - op_data->header_length, "[%d:%d:%d] %s [Classification: %s] " - "[Priority: %d] {%s} %s:%d -> %s:%d", + "[Priority: %d]: <%s> {%s} %s:%d -> %s:%d", record->event.sig_generator, record->event.sig_id, record->event.sig_rev, sid != NULL ? sid->msg : "ALERT", class_type != NULL ? class_type->name : "Unknown", - record->event.priority, protocol_names[record->protocol], + record->event.priority, pv.interface, protocol_names[record->protocol], src, record->sp, dest, record->dp); break; case IPPROTO_ICMP: length = snprintf(op_data->message_buffer + op_data->header_length, MESSAGE_LENGTH - op_data->header_length, "[%d:%d:%d] %s [Classification: %s] " - "[Priority: %d] {%s} %s -> %s", + "[Priority: %d]: <%s> {%s} %s -> %s", record->event.sig_generator, record->event.sig_id, record->event.sig_rev, sid != NULL ? sid->msg : "ALERT", class_type != NULL ? class_type->name : "Unknown", - record->event.priority, protocol_names[record->protocol], + record->event.priority, pv.interface, protocol_names[record->protocol], src, dest); break; default: length = snprintf(op_data->message_buffer + op_data->header_length, MESSAGE_LENGTH - op_data->header_length, "[%d:%d:%d] %s [Classification: %s] " - "[Priority: %d] {%s} %s -> %s", + "[Priority: %d]: <%s> {%s} %s -> %s", record->event.sig_generator, record->event.sig_id, record->event.sig_rev, sid != NULL ? sid->msg : "ALERT", class_type != NULL ? class_type->name : "Unknown", - record->event.priority, protocol_names[record->protocol], + record->event.priority, pv.interface, protocol_names[record->protocol], src, dest); break; }