[Snort-users] 2GB limit?

DataShark nomad at ...7970...
Fri Jan 10 10:59:18 EST 2003


My personal fav fix for this:

ln -s /dev/null /var/log/snort/alert
:)
		DS
On Thu, 9 Jan 2003 14:53:23 -0500
"Henning, David" <henningd at ...7800...> wrote:

> I was under the impression that any 32-bit system (x86 architecture) was
> limited to the 2GB file size.  Use logrotate or something to keep the file
> sizes managable.
> 
> 
> 
> -----Original Message-----
> From: Javier Liendo [mailto:javier at ...7920...] 
> Sent: Thursday, January 09, 2003 2:33 PM
> To: Sammy X; snort-users at lists.sourceforge.net
> Subject: Re: [Snort-users] 2GB limit?
> 
> 
> hello
> 
> because of the configuration you mentionend you are
> using the ext3 filesystem and afaik that's a limit
> imposed by the filesystem iteself: no file can be
> bigger than 2GB. i used to have a hogwash process that
> crashed everytime the log file grew more than 2GB
> long...hope it helps...
> 
> saludos
> 
> javier
> 
> --- Sammy X <sammy7887 at ...131...> wrote:
> > 
> > Has anyone else run into any problems where logging
> > in tcpdump format stops once the log file reaches
> > 2GB?  I'm using Snort 1.8.6 (Build 105) on a Redhat
> > 7.2 box with kernel 2.4.7-10.  My libpcap is the one
> > the came with Redhat (0.6.2-9).  From what I've read
> > so far, it looks like the problem is with libpcap
> > not having been compiled with LFS.  Any
> > thoughts/suggestions?  Any help is greatly
> > appreciated!  Thanks in advance.
> > 
> > Sammy
> > 
> > 
> > 
> > ---------------------------------
> > Do you Yahoo!?
> > Yahoo! Mail Plus - Powerful. Affordable. Sign up now
> 
> 
> 
> -------------------------------------------------------
> This SF.NET email is sponsored by:
> SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
> http://www.vasoftware.com _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 
> 
> 
> ..
> .
> 
> 
> -------------------------------------------------------
> This SF.NET email is sponsored by:
> SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
> http://www.vasoftware.com
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20030110/27a5f71f/attachment.sig>


More information about the Snort-users mailing list