search

beave / sagan

** README ** This repo has MOVED to https://github.com/quadrantsec/sagan
http://sagan.quadrantsec.com
229 stars 64 forks source link

Output Options / FIFO #129

Open SpudDogg opened 5 years ago

SpudDogg commented 5 years ago

Is your feature request related to a problem? Please describe. Sagan can currently only output eve logs to regular file, and only one at a time.

Describe the solution you'd like The ability to output eve to a file, example /var/log/sagan.json while simultaneously writing to another log, perhaps to a ramdisk /tmp/ramdisk/sagan.json.

Also, Sagan cannot output eve to a fifo. There are workarounds where this does work, however Sagan will not keep the fifo open and let data spool when a reader/listener is not running.

Ideally, I'd be able to write eve to disk and a fifo simultaneously!

Describe alternatives you've considered I looked into Suricata, and while it does not specify fifo as an output file type, there are options for unix_stream, unix_dgram, etc.

beave commented 5 years ago

You might want to look at Meer (https://github.com/beave/meer). It will let you write to databases, redis, fifo, etc. at the same time. It's still new software but might help.

beave commented 5 years ago

Meer will also write to a pipe as well.. :)

beave commented 4 years ago

Does this help? Or do you think it would still be better to have multiple outputs?

SpudDogg commented 4 years ago

Does this help? Or do you think it would still be better to have multiple outputs?

Thank you for the replies. I'm not using Meer, instead a combination of ramdisk files as a workaround. I would definitely prefer the ability to have Sagan output directly to a combination of files and fifos. It would be ideal to have the ability to write logs to one file (or fifo) and alerts to a separate file (or fifo).

Thank you again for your work!

beave commented 4 years ago

What type of data are you trying to inject? I'll have to ponder this more to determine if it's worth the time. That is, is the dev time better here than elsewhere. Thank you.