[Snort-users] output log_tcpdump bulk.log

Bob Hillegas bobhillegas at ...3133...
Wed Mar 6 19:30:03 EST 2002


Thanks John for the script. It wasn't exactly what I wanted, but got me 
off dead-center. I wanted the file names to include the timestamp when 
they were created, what you get from ls -lu (access time).

Instead of using cron, I place this script in my ifdown-local. It gets 
called each time the ppp0 interface goes down. I kill snort at that point 
and then move the files.

Since my pppd is set up as on demand, I don't want to wait for a specific 
cron interval, and find out that snort has been invoked already and 
overwritten the file.

Thanks, BobH

#!/bin/bash
# Move snort.log & bulk.log files to correctly state time
# MMDD at ...5221... --> YYYYMMDD-HHMMSS-packet.log
# MMDD at ...5222... --> YYYYMMDD-HHMMSS-alert.log
#

TDIR=/var/log/snort/

for fil in ${TDIR}*-bulk.log; do
  TSNAM=`find $fil -printf %AY%Am%Ad-%AH%AM%AS-packet.log `
  mv -i $fil ${TDIR}${TSNAM}
done

for fil in ${TDIR}*-snort.log; do
  TSNAM=`find $fil -printf %AY%Am%Ad-%AH%AM%AS-alert.log `
  mv -i $fil ${TDIR}${TSNAM}
done

# That's all :-)
exit

-- 
-------------------------------------------------
Bob Hillegas           
<bobhillegas at ...3133...> 
281.546.9311          

On Wed, 6 Mar 2002, John Sage wrote:

 Date: Wed, 6 Mar 2002 06:04:55 -0800
 From: John Sage <jsage at ...2022...>
 To: Bob Hillegas <bobhillegas at ...3133...>
 Cc: snort-users at lists.sourceforge.net
 Subject: Re: [Snort-users] output log_tcpdump bulk.log
 
 Bob:
 
 If you've already got cron involved, write a shell or perl script that
 runs from cron and renames the file..
 
 Here's something I use (perl wizards: don't laugh :-)
 
 #!/usr/bin/perl
 #
 # run from /etc/crontab by:
 #   00 4 * * * root /bin/sh /var/log/snort/rotate_counts.plx
 #   minute 00, hour 04, * * * rotate counts, datestamp, touch new
 #
 $t = `date +%m%d%y%H%M`;
 system("mv -f /var/log/snort/count_ports /var/log/snort/count_ports.$t");
 system("mv -f /var/log/snort/count_probes /var/log/snort/count_probes.$t");
 system("mv -f /var/log/snort/count_probes_sort /var/log/snort/count_probes_sort.$t");
 #
 system("touch /var/log/snort/count_ports");
 system("touch /var/log/snort/count_probes");
 system("touch /var/log/snort/count_probes_sort");
 #
 # EOF rotate_counts.plx 09/29/01
 
 
 HTH..
 
 - John
 





More information about the Snort-users mailing list