[Snort-users] Large mysql files in folder /usr/local/mysql/var (Redhat Linux 8.0 ver)

Sudhakar Gummadi sgummadi at ...8733...
Mon Sep 8 20:57:03 EDT 2003


I was wondering how I could resolve the issue of the file size growing very large more than 1GB in the following folder /usr/local/mysql/var with the file names as

 IDSsnort-bin.001 ,002 and so on... One of our Snort box running on Linux had used 100%  disk space and crashed.

 Are there any automated scripts which can delete the older file to make space on the hard disk.

Any suggestion really appreciated.

Thanks
SG

-----Original Message-----
From: Erek Adams [mailto:erek at ...950...]
Sent: Wednesday, August 06, 2003 8:33 AM
To: m.stiefenhofer at ...9624...
Cc: rvennell at ...9347...; snort-users at lists.sourceforge.net
Subject: Re: Antwort: [Snort-users] IP Range Problems


On Wed, 6 Aug 2003 m.stiefenhofer at ...9624... wrote:

> >i want snort to look at the ip range of 10.5.0.1 - 10.5.4.254 but i
> >cant figure out how to input this into the ip list.  how do i put that
> >into the var HOME_NET list?  thanks for any help
>
> var HOME_NET 10.5.0.0/22

Sorry, that's not going to work.

Ipcalc is your friend!

[erek at ...6976...]~>ipcalc 10.5.0.0/22

Address:   10.5.0.0              00001010.00000101.000000 00.00000000
Netmask:   255.255.252.0 = 22    11111111.11111111.111111 00.00000000
Wildcard:  0.0.3.255             00000000.00000000.000000 11.11111111
=>
Network:   10.5.0.0/22           00001010.00000101.000000 00.00000000
(Class A)
Broadcast: 10.5.3.255            00001010.00000101.000000 11.11111111
HostMin:   10.5.0.1              00001010.00000101.000000 00.00000001
HostMax:   10.5.3.254            00001010.00000101.000000 11.11111110
Hosts/Net: 1022                  (Private Internet RFC 1918)

It won't catch the 10.5.4.x net.  You'll need to use something else.

Since the more subnets you throw at HOME_NET the more Snort has to work,
you'll come out with:

	var HOME_NET [10.5.0.0/22,10.5.4.0/24]

Cheers!


-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users




More information about the Snort-users mailing list