RE: snort tcpdump binary file mirroing over network.

["samwun" <samwun () hgcbroadband com>]

-----Original Message-----
From: Erek Adams [mailto:erek () snort org] 
Sent: Saturday, October 25, 2003 2:47 AM
To: samwun
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] snort tcpdump binary file mirroing over
network.

On Fri, 24 Oct 2003, samwun wrote:

> I found that when I enabled tcpdump output module, binary file
> tcpdump.log is stored in the sensor. I would like to mirror a dir or
> file system which contains tcpdump.log file generated by Snort. I want
> to keep a copy of this file system (contains binary file tcpdump.log)
> stored in a remote server as well.
>
> I found that verita Volume Manager/Replicator can do mirroring, but it
> is commercial and I am not sure whether it is suitable for this
> instance.
>
> Any comment and suggestion is very appreciated.

What's wrong with sending Snort a SIGHUP once an hour, and then using
something like:

        scp tcpdump.file otherhost:/some/dir/for/snort/

May bet it works, but I am concerning how many tcpdump.log files I have
to copy over to a remote server at the end of a day or week or even
months..
I supposed every time when you do a HUP on snort, there will be new
tcpdpump.log file generated with different number at the end of the
file, eg. tcpdump.log.3984938, while previous tcpdump.log.xxxxx files
are still in the directory (/var/log/snort/). Every time when we do a
scp, it will end up copying all the previous files over and over
again...


Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson



-------------------------------------------------------
This SF.net email is sponsored by: The SF.net Donation Program.
Do you like what SourceForge.net is doing for the Open
Source Community?  Make a contribution, and help us add new
features and functionality. Click here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users