2. Available logging facilities
Prev | Chapter 4. Configuration of logging facilities | Next

## 2. Available logging facilities

samhain supports the following facilities for logging:

- e-mail — samhain uses built-in SMTP code, rather than an external mailer program. E-mails are signed to prevent forging.

- syslog — The system logging utility.

- console — If running as daemon, `/dev/console` is used, otherwise stderr. `/dev/console` can be replaced by other devices, including a FIFO.

- log file — Entries are signed to provide tamper-resistance.

- log server — samhain uses TCP/IP with strong authentication and signed and encrypted messages.

- external — samhain can be configured to invoke external programs for logging and/or taking some action upon certain conditions.

- SQL db — Currently samhain supports MySQL, PostgreSQL, Oracle, and unixODBC.

- Prelude — samhain can be compiled with support for the Prelude IDS, i.e. it can be used as a Prelude sensor.

Each of these logging facilities has to be activated by setting an appropriate threshold on the messages to be logged by this facility.

| Note
In addition, some of these facilities require proper settings in the configuration file (see next sections).

Prev | Up | Next
Chapter 4. Configuration of logging facilities | Home | 3. Activating logging facilities and filtering messages