search

mushorg / conpot

ICS/SCADA honeypot
GNU General Public License v2.0
1.24k stars 415 forks source link

unable to move the logs to syslog #453

Open dsshobha opened 5 years ago

dsshobha commented 5 years ago

[syslog] enabled = True device = /dev/log host = localhost port = 514 facility = local0 socket = udp ; udp (sends to host:port), dev (sends to device)

this is the syslog configuration,but i'm not getting the logs in syslog

glaslos commented 3 years ago

Did you confirm you can receive a syslog on port 514? Any error messages?

ssabetan commented 3 years ago

Below is the affected line that stops syslog from functioning correctly. In your cfg file, replace:

socket = udp ; udp (sends to host:port), dev (sends to device))

with

socket = udp

In syslog.py, the comparison is str(logsocket).lower() == 'udp':. The entire line from the configuration (including comments) are being passed to syslog.py.