[Snort-users] Snort daily reports

Dave Rutherford dave at ...14014...
Tue Jan 16 19:06:51 EST 2007


On 1/4/07, Dave Rutherford <dave at ...14014...> wrote:
> On 1/3/07, info+lucretia.ca <info at ...2282...> wrote:
> > Snort daily reports?  What tool is this?
> >
> > Snort has no email or reporting functions.
>
> That's a fair question; I've no idea.  As I said, I'm using the
> Debian packages, and I don't have anything installed with
> a name remotely like 'snort-reporter'.

Found it.  Debian's cron packaging leaves some things to
be desired, but there's a script in /etc/cron.daily/5snort
containing:

   (echo "To: $DEBIAN_SNORT_STATS_RCPT"; snort-stat -a -t
$DEBIAN_SNORT_STATS_THRESHOLD < $LOGFILE) | sendmail -t

(LOGFILE being defined as LOGFILE=/var/log/snort/alert)

Apparently this file is never pruned.  Could anybody tell me why?

Dave




More information about the Snort-users mailing list