Snort mailing list archives
Snort init script `stats` function
From: Peter Gallagher via Snort-devel <snort-devel () lists snort org>
Date: Wed, 23 Aug 2017 12:31:39 +0100
The current `stats` function in the init.d script has been very unreliable for me, due to variations in the `startdate` variable recorded in the script and the timestamp when the log lines are actually written by snort. Accordingly I have modified my init script to use the following: tac /var/log/messages | grep -m1 '*** Caught Dump Stats-Signal' -B147 | tac | grep snort.*: | cut -d: -f4- This example of the basic `stats` function does the following: 1. Uses `tac` to reverse the order of `$SYSLOG` 2. Greps for the first occurrence of the snort stats start signature and includes an additional 147 lines of output 3. Reverses the order (again using `tac`) to return it to normal order 4. Filters out any non-snort lines I think this is a more reliable approach. The only risk is if the stats aren't dumped correctly it could return an earlier collection of statistics, however I feel this is highly unlikely. I looked for a public repository to provide a diff or pull request but could not find any. Please let me know if you think this is suitable for inclusion for future releases. Regards, Peter
_______________________________________________ Snort-devel mailing list Snort-devel () lists snort org https://lists.snort.org/mailman/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Snort init script `stats` function Peter Gallagher via Snort-devel (Aug 23)
- Re: Snort init script `stats` function Peter Gallagher via Snort-devel (Aug 23)
- Re: Snort init script `stats` function Bill Parker via Snort-devel (Aug 23)
- Re: Snort init script `stats` function Peter Gallagher via Snort-devel (Aug 23)