Re: >2Gb capture files

[Ryan Russell <ryan () securityfocus com>]

On 6 Jul 2001, Chris Green wrote:

> I think the real key is change snort so that the HUP mode to rotate
> logs works better than reexecing itself ( essentially a restart ).

Sounds more like you'd want Snort to have a maximum log size, and a
maximum number of logs to keep around.  BlackICE defender does that.
DJB's various logging tools do that, too.  You don't want to have to have
a process that sits around watching the log file size, and hup Snort when
it gets to a certain size.

                                        Ryan



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users