[Snort-users] snort & logfile permissions

Erek Adams erek at ...577...
Wed Aug 14 15:38:03 EDT 2002


On Wed, 14 Aug 2002, Sander Smeenk wrote:

> Can anyone tell me if, and how, I can have snort create it's logfiles
>
> -rw-r-----	snort.snort			alert
>
> So that I can put users who need to read the logs in group 'snort' etc?
> Currently it just creates the files as mode 600 :/

*sigh*

It's amazing what you can find in the docs, man pags, and help from the
program.

---

[erek at ...3978...]/var/log/snort#snort -\?
Initializing Output Plugins!

-*> Snort! <*-
Version 1.9.0beta (Build 175)
By Martin Roesch (roesch at ...1935..., www.snort.org)
USAGE: snort [-options] <filter options>
Options:

[...snip...]

        -m <umask> Set umask = <umask>

[...snip...]

---

And also from:

---

[erek at ...3978...]/var/log/snort#man snort

[...snip...]

     -m umask
          Set the file mode creation mask to umask

[...snip...]

---

And also from:

---

http://www.snort.org/docs/writing_rules-1.9.0/chap2.html#tth_sEc2.1.3

[...snip...]

  umask
       Umask when running (snort -m). Example: config umask: 022

[...snip...]

---

Three penalty drinks.

Cheers!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net





More information about the Snort-users mailing list