[Snort-users] Snort log file size is getting huge

Maged Shenouda maged67 at ...125...
Tue Jul 23 12:33:09 EDT 2013


If that the case, then any system could be out of space if it doesn't enforce the size limit and I would have to use the systems log rotation settings
 

 
> Date: Tue, 23 Jul 2013 12:25:17 -0400
> From: wkitty42 at ...14940...
> To: snort-users at lists.sourceforge.net
> Subject: Re: [Snort-users] Snort log file size is getting huge
> 
> On 7/23/2013 11:18, Maged Shenouda wrote:
> > I am sorry, but the local.rules file was active with the following rules, that's
> > why I got hit with everything
> 
> ahh, yes... you did first place those as local.rules instead of local-test.rules 
> as instructed... that will definitely cause snort to read and log all traffic...
> 
> > but even though, shouldn't it be limited to 128 mb accorfing to the snort.conf?
> 
> i haven't dug into the code by it may do that during a quiet period when it is 
> not busy snorting traffic... the main goal is to snort traffic so other tasks 
> may be put off until a quiet period... just a WAG on my part ;)
> 
> -- 
> NOTE: No off-list assistance is given without prior approval.
>        Please keep mailing list traffic on the list unless
>        private contact is specifically requested and granted.
> 
> ------------------------------------------------------------------------------
> See everything from the browser to the database with AppDynamics
> Get end-to-end visibility with application monitoring from AppDynamics
> Isolate bottlenecks and diagnose root cause in seconds.
> Start your free trial of AppDynamics Pro today!
> http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> 
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130723/e82683b4/attachment.html>


More information about the Snort-users mailing list