I recently needed to setup Snort Intrusion Detection with real time alerts and an ACID/database setup was overkill. Logdog was perfect for the situation. I like to use reliable open-source products over other products. I find it easier to avoid telephone calls at 4 AM by using Linux! ;-) For what it is worth I wrote up my directions. They might be helpful for others who use LogDog with Snort.

LogDog with Snort
One of my duties is handling the security for the worldwide website and North American network of a manufacturing firm. My title is "Oracle DBA." You probably cannot imagine how odd this is to juggle these completely different roles. I don't need an ACID Snort setup [yet]. I just wanted realtime emails and pages from Snort using Syslog. Here is how I did it. I prefer Redhat Linux. The RPM packages coupled with apt-get is good for me. This example is with Redhat 7.2 and it should work with 7.3 and 8.0 too.

First thing is to download the apt-get and bring everything up to date for the O/S. Then get Snort (tar.gz or Rpm will work). And logdog. You should already know what to configure on the operating system and getting snort operational. There are basically three tasks for modification, Logdog, Syslog and Snort. I put the IDS just inside the firewall with an unswitched 100mb hub so it sniffs everything coming in and going out to the T1.

Logdog
Install Logdog per the directions. In the /etc/logdog.conf I modified the following info for having postfix installed locally. Postfix is much faster and more secure than Sendmail.
email me => echo "MESSAGE" |/bin/mail -s "logdog alert from MACHINE NAME" you@domain.com
Added some appropriate keywords from Snort {only a few shown here}:
SCAN => email me
ICMP => email me
WEB-IIS => email me
P2P => email me
POLICY => email me
MULTIMEDIA => email me
TELNET => email me

Added "/usr/local/sbin/logdog.pl -d -v &" in the /etc/rc.d/rc.local file so logdog starts automatically.

Syslog
changed /etc/syslog.conf to have these lines:
*.info;mail.none;authpriv.none;cron.none;local5.*
/var/log/messages
*.info;local5.* |/var/log/fifo.logdog
The key element here is that local5.* is in both. What I'm doing is getting logdog to see the Snort alerts.
Snort
In the /etc/snort/snort.conf I added this:
output alert_syslog: LOG_LOCAL5 LOG_INFO
So all Snort alerts are written in Syslog format with info level via LOCAL5.
I start snort with this line:
usr/sbin/snort -l /var/log/snort -D -h x.x.x.x/24 -c /etc/snort/snort.conf

Application logging is on, x.x.x.x should be your subnet, and in daemon mode. Be forewarned, you will need to decide what alerts you want because initially you will be overwhelmed with info! I found the webmin plugin for Snort to be very helpful in my configuration.

Putting it all together for use.
You need to bounce your syslog, start logdog, and start snort:
/etc/init.d/syslog restart
/etc/rc.d/rc.local
usr/sbin/snort -l /var/log/snort -D -h x.x.x.x/24 -c /etc/snort/snort.conf

You can now use the syslog.pl from logdog, or start up Kazaa, or use a port scanner, etc. and get alerts in real time from Snort to your email address and/or pager.