SAGAN(8)

📦 version 1.2.0, in debian bookworm, ubuntu jammy, ubuntu noble

💖 SAGAN 💖 — like, the system manager's manual bestie edition (section 8)

okay so this is SAGAN(8), from the System Manager's Manual — and honestly? she's iconic.

✨ NAME ✨

sagan — Real-time System & Event Log Monitoring System 🦋

✨ SYNOPSIS ✨

sagan [options]

✨ DESCRIPTION ✨

So bestie, this manual page documents briefly the sagan command. Brief. Slay. Let's go 💅

sagan is a multi-threaded, real time system- and event-log monitoring system — but with a twist 🌪️. The twist is that Sagan uses a “Snort” like rule set for detecting malicious events happening on your network and/or computer systems. Yes ma'am, Snort-style rules, doing the absolute most.

And if Sagan detects a potentially bad event? That event can be:

  • stored to a Snort database (MySQL/PostgreSQL),
  • sent to a SIEM tool like Prelude,
  • or sent as an email 📧

Sagan is meant to be used in a ‘centralized’ logging environment, but she will work perfectly fine as part of a standalone Host IDS system for workstations too. Versatile queen 👑

✨ OPTIONS ✨

These programs follow the usual GNU command line syntax, with long options starting with two dashes (`-`). A summary of options is included below. No skipping, we're doing all of them 🫶

  • -h, --help — Show summary of options. Your lil "what does this do again" button.
  • -d, --debug — Enable debugging. The tea-spilling mode 🔍
  • -D, --daemon — Make process a daemon (fork to the background). She's leaving the group chat to go be mysterious.
  • -U, --user — Run as user (defaults to 'sagan'). She has her own lil username, periodt.
  • -c, --chroot — Chroot to username 'sagan''s home 🏠
  • -f, --config — Sagan configuration file to load 📂
  • -p, --program — Run Sagan in syslog-ng's 'program' mode.

✨ AUTHOR ✨

sagan was written by Champ Clark, III <champ@softwink.com> 👑

This manual page was written by Pierre Chifflier <pollux@debian.org>, for the Debian project (and may be used by others). Giving credit where credit is due, always 💖

okay that's the whole page, no cap, nothing skipped, every single flag accounted for 🎀 and a cute lil sign-off: this version is dated February 15, 2011 and it lives in the System Manager's Manual — SAGAN(8), bestie. bye bestie, go monitor some logs 💜🌸

📦 where this page comes from