NAME

       sagan - Real-time System & Event Log Monitoring System

SYNOPSIS

       sagan [options]

DESCRIPTION

       This manual page documents briefly the sagan command.

       sagan  is  a  multi-threaded,  real time system- and event-log monitoring system, but with a twist. Sagan
       uses a “Snort” like rule set for detecting malicious events happening on  your  network  and/or  computer
       systems.
       If   Sagan   detects   a   potentially  bad  event,  that  event  can  be  stored  to  a  Snort  database
       (MySQL/PostgreSQL), send it to a SIEM tool like Prelude, or send an email.
       Sagan is meant to be used in a ‘centralized’ logging environment,  but  will  work  fine  as  part  of  a
       standalone Host IDS system for workstations.

OPTIONS

       These  programs  follow  the  usual  GNU  command line syntax, with long options starting with two dashes
       (`-').  A summary of options is included below.

       -h, --help
              Show summary of options.

       -d, --debug
              Enable debugging

       -D, --daemon
              Make process a daemon (fork to the background)

       -U, --user
              Run as user (defaults to 'sagan')

       -c, --chroot
              Chroot to username 'sagan's home

       -f, --config
              Sagan configuration file to load

       -p, --program
              Run Sagan in syslog-ng's 'program' mode

AUTHOR

       sagan was written by Champ Clark III <champ@softwink.com>

       This manual page was written by Pierre Chifflier <pollux@debian.org>, for the Debian project (and may  be
       used by others).

                                                February 15, 2011                                       SAGAN(8)