[Snort-users] Snort daily reports
dave at ...14014...
Tue Jan 16 19:06:51 EST 2007
On 1/4/07, Dave Rutherford <dave at ...14014...> wrote:
> On 1/3/07, info+lucretia.ca <info at ...2282...> wrote:
> > Snort daily reports? What tool is this?
> > Snort has no email or reporting functions.
> That's a fair question; I've no idea. As I said, I'm using the
> Debian packages, and I don't have anything installed with
> a name remotely like 'snort-reporter'.
Found it. Debian's cron packaging leaves some things to
be desired, but there's a script in /etc/cron.daily/5snort
(echo "To: $DEBIAN_SNORT_STATS_RCPT"; snort-stat -a -t
$DEBIAN_SNORT_STATS_THRESHOLD < $LOGFILE) | sendmail -t
(LOGFILE being defined as LOGFILE=/var/log/snort/alert)
Apparently this file is never pruned. Could anybody tell me why?
More information about the Snort-users