Snort mailing list archives
Re: I have deleted the file /var/log/snort/alert and i dont see snort writing on it now.
From: Edin Dizdarevic <Edin.Dizdarevic () interActive-Systems de>
Date: Fri, 02 Jan 2004 09:42:21 +0100
Hi, if the file is still opened by Snort (check that with "lsof +L1"), you may still be able to rescue it using the proc-fs. Find out with which PID the Snort process is running: "pidof snort" or "ps -ax | grep snort". See under "/proc/*Snort-PID*/fd/*FD-number*" if you can find your alertfile. If you have lsof (list open files) you may find out, which FD-number it have:
lsof -p `pidof snort` | grep alert snort 3696 root 6w REG 3,3 2832839 164515 /var/log/snort/alert... Where the columns are: COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME So now do a (example here) cat /proc/3696/fd/6 > /var/log/snort/alert_saved and you got your file back. Rename the file to alerts again and restart Snort, since it will continue to log to the old (deleted) alerts file. If you restarted Snort in the meantime, you may check some links handling computer forensics, hoping your file is still somewhere on your HD and has not been overwritten yet. Regards, Edin soldier Mx wrote:
Hello! im here again with problems and.. as i was seeing that the
[...] ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- I have deleted the file /var/log/snort/alert and i dont see snort writing on it now. soldier Mx (Jan 02)
- Re: I have deleted the file /var/log/snort/alert and i dont see snort writing on it now. Edin Dizdarevic (Jan 02)
- Re: I have deleted the file /var/log/snort/alert and i dont see snort writing on it now. Michael Boman (Jan 02)