Snort mailing list archives
Re: Rotating '-b' logs without stopping snort? (0% data loss...)
From: Ramin Alidousti <ramin () cannon eng us uu net>
Date: Tue, 24 Jul 2001 08:53:10 -0400
Is it not easier to have a signal handler to re-open the logfile. This way you can move the logfile to logfile.prev and send it the signal. Lots of servers do this and I'm sure that even I can implement this functionality :-) Or am I totally off track? Ramin On Tue, Jul 24, 2001 at 07:25:10AM -0500, Johannes Grosen wrote:
On Tue, Jul 24, 2001 at 05:01:47AM -0400, Dave Cinege wrote:I'm creating a distributed 'total system', in which snort will reside on several satellite hosts. The idea is to have snort log '-b' (tcpdump binary) on the hosts and then transfer these to a master host that will dump the logs in to normal verbose directory format. The desire is for the data to be kept as synced as possible with the master host. (IE within a few minutes) Problem: If I am constantly restarting snort, I will miss packet data inbetween the stop time. I have tried to 'slide' the snort.log file, by `sync,cp,:>` (truncate) praying buffering would always work to my advantage. However it's leaving me with corrupted log files. How can I resolve this? If I need to do some recoding of snort I can, though KISS is best. (I was thinking maybe sending a signal to the process to pause file writing and buffer util getting another signal to resume writing) Any suggestions appreciated.Why not take the following approach: write a script that grabs the current snort process ID and removes the pid file. Then start a second snort process. I would consider using the new -L command line option to name the log files. Once the second snort is running you can kill the first snort by sending a signal to the saved PID. Yes, there will be some overlap in packet capturing between the two but if you absolutely can't miss any packets then this seems to be the approach to take. -- Johannes "John" Grosen, M.S., Assoc. Dir. NDHECN South Host Site Information Technology Services http://www.nodak.edu/ North Dakota State University http://www.ndsu.nodak.edu/ Fargo, ND 58105-5164 (701) 231-1042
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Rotating '-b' logs without stopping snort? (0% data loss...) Dave Cinege (Jul 24)
- Snort 1.8 and Acid Problem Alessandro Fiorenzi (Jul 24)
- Re: Rotating '-b' logs without stopping snort? (0% data loss...) snort-users (Jul 24)
- network output strategies (was: Rotating '-b'logs...) Kiira Triea (Jul 24)
- Re: network output strategies (was: Rotating '-b'logs...) Ben Hughes (Jul 24)
- Re: Rotating '-b' logs without stopping snort? (0% data loss...) Dave Cinege (Jul 24)
- network output strategies (was: Rotating '-b'logs...) Kiira Triea (Jul 24)
- Re: Rotating '-b' logs without stopping snort? (0% data loss...) Pawel Krawczyk (Jul 24)
- Re: Rotating '-b' logs without stopping snort? (0% data loss...) Johannes Grosen (Jul 24)
- Re: Rotating '-b' logs without stopping snort? (0% data loss...) Ramin Alidousti (Jul 24)
- Re: Rotating '-b' logs without stopping snort? (0% data loss...) Chris Keladis (Jul 24)