[Snort-users] Help with tcpdump log rotation
egarnel3470 at ...131...
Fri May 3 09:22:02 EDT 2002
Sorry, I can't be of mcuh help, but would like to know how you solve
it, as I too am experiencing the same problem
--- Rob Hughes <rob at ...1932...> wrote:
> Ok... I admit it... I'm not bright enough to figure this out. Since
> snort now logs in tcpdump format with the date at ...5773... or
> snort-date at ...5774... (depending on whether you specify tcpdump
> from the command line or from the snort.conf file) format, I can't
> a log rotation daemon that supports regex for file names, so, I'm
> to write a script to do it. However, I can't figure out how to get
> bloody thing to work reliably. I'm hoping that someone on here with
> experience scripting (most of you) can either point me somewhere I
> look at an example, or already has a script that does this.
> the only choice I can see is just turning off the binary logging,
> I'd really rather not do, but I also don't want my var slice
> filling up
> any more, which seems to happen every time I go out of town.
> What would be even nicer, IMO, would be to make adding the date and
> an option, rather than hard coding it into log.c. I still fail to
> the value in doing this, since I (although I realize others don't)
> the log with the date and time the log was archived. Or at least I
> Have big pipes? SourceForge.net is looking for download mirrors. We
> the hardware. You get the recognition. Email Us:
> bandwidth at ...382...
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> Snort-users list archive:
Do You Yahoo!?
Yahoo! Health - your guide to health and wellness
More information about the Snort-users