SAGAN(8)						      System Manager's Manual							  SAGAN(8)

NAME

       sagan - Real-time System & Event Log Monitoring System

SYNOPSIS

       sagan [options]

DESCRIPTION

       This manual page documents briefly the sagan command.

       sagan  is  a  multi-threaded,  real  time system- and event-log monitoring system, but with a twist. Sagan uses a "Snort" like rule set for
       detecting malicious events happening on your network and/or computer systems.
       If Sagan detects a potentially bad event, that event can be stored to a Snort database (MySQL/PostgreSQL), send it to a SIEM tool like Pre-
       lude, or send an email.
       Sagan  is  meant to be used in a 'centralized' logging environment, but will work fine as part of a standalone Host IDS system for worksta-
       tions.

OPTIONS

       These programs follow the usual GNU command line syntax, with long options starting with  two  dashes  (`-').   A  summary  of  options	is
       included below.

       -h, --help
	      Show summary of options.

       -d, --debug
	      Enable debugging

       -D, --daemon
	      Make process a daemon (fork to the background)

       -U, --user
	      Run as user (defaults to 'sagan')

       -c, --chroot
	      Chroot to username 'sagan's home

       -f, --config
	      Sagan configuration file to load

       -p, --program
	      Run Sagan in syslog-ng's 'program' mode

AUTHOR

       sagan was written by Champ Clark III <champ@softwink.com>

       This manual page was written by Pierre Chifflier <pollux@debian.org>, for the Debian project (and may be used by others).

								 February 15, 2011							  SAGAN(8)