[Snort-users] How to enable mail notication?

Glenn E. Bailey III gbailey at ...4424...
Wed Jan 23 08:02:14 EST 2002

Here is a quick and really dirty script I run, you have
to setup snort to log via syslog and setup syslog to log
snort alerts to a seperate file .. Only good if you have
a small site really, and like I said, it's dirty:


use strict;

my $snort_log     = '/var/log/snort.log'; # location of snort.log generated
by syslog
my $snort_log_old = '/var/log/snort/old/snort'; # path to dir where to store
old logs
my $notify_log    = '/var/log/snort/notify.log'; # path to log where to log
my $email         = 'youremail at ...4651...'; # guess what this is ;-)

open(SNORT_LOG, "$snort_log");

if (! <SNORT_LOG>) {

else {
        system("mail $email -s \"Snort alert\" < $snort_log");

        open(NOTIFY, ">>$notify_log");
        my $localtime = localtime();
        print NOTIFY "$localtime - Alert sent to $email\n";
        close NOTIFY;

        my $time = time();
        system("mv $snort_log $snort_log_old.$time");
        system("kill -SIGHUP \`cat /var/run/syslogd.pid\`");

-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net]On Behalf Of Erek Adams
Sent: Wednesday, January 23, 2002 9:50 AM
To: My Security
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] How to enable mail notication?

On Wed, 23 Jan 2002, My Security wrote:

> I would like to enable sending mail if there is alert
> on my email address.
> How will I be able to configure this option to the
> snort.conf.

You can't.


Also read the users manual from the Documentation page.  The rest of the FAQ
won't hurt either....

Erek Adams

Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list