Available logging facilities

Samhain
Prev | Chapter 4. Configuration of logging facilities | Next

# 4.2. Available logging facilities

samhain supports the following facilities for logging:

- e-mail — samhain uses built-in SMTP code, rather than an external mailer program. E-mails are signed to prevent forging.

- syslog — The system logging utility.

- console — If running as daemon, `/dev/console` is used, otherwise stderr. `/dev/console` can be replaced by other devices, including a FIFO.

- log file — Entries are signed to provide tamper-resistance.

- log server — samhain uses TCP/IP with strong authentication and signed and encrypted messages.

- external — samhain can be configured to invoke external programs for logging and/or taking some action upon certain conditions.

- SQL db — Currently samhain supports MySQL, PostgreSQL, Oracle, and unixODBC.

- Prelude — samhain can be compiled with support for the Prelude IDS, i.e. it can be used as a Prelude sensor.

Each of these logging facilities has to be activated by setting an appropriate threshold on the messages to be logged by this facility.

| Note
| In addition, some of these facilities require proper settings in the configuration file (see next sections).

Prev | Home | Next
Configuration of logging facilities | Up | Activating logging facilities and filtering messages