Re: Rotating '-b' logs without stopping snort? (0% data loss...)

[Ramin Alidousti <ramin () cannon eng us uu net>]

Is it not easier to have a signal handler to re-open the
logfile. This way you can move the logfile to logfile.prev
and send it the signal. Lots of servers do this and I'm sure
that even I can implement this functionality :-) Or am I totally
off track?

Ramin

On Tue, Jul 24, 2001 at 07:25:10AM -0500, Johannes Grosen wrote:

> On Tue, Jul 24, 2001 at 05:01:47AM -0400, Dave Cinege wrote:
> > I'm creating a distributed 'total system', in which 
> > snort will reside on several satellite hosts.
> >
> > The idea is to have snort log '-b' (tcpdump binary) on the
> > hosts and then transfer these to a master host that will
> > dump the logs in to normal verbose directory format.
> >
> > The desire is for the data to be kept as synced as
> > possible with the master host. (IE within a few minutes)
> >
> > Problem: 
> > If I am constantly restarting snort, I will miss packet data inbetween
> > the stop time.
> >
> > I have tried to 'slide' the snort.log file, by `sync,cp,:>` (truncate)
> > praying buffering would always work to my advantage. However
> > it's leaving me with corrupted log files.
> >
> > How can I resolve this? If I need to do some recoding of snort I can, though
> > KISS is best. (I was thinking maybe sending a signal to the
> > process to pause file writing and buffer util getting another signal
> > to resume writing)
> >
> > Any suggestions appreciated.
>
> Why not take the following approach: write a script that grabs the
> current snort process ID and removes the pid file. Then start a second
> snort process. I would consider using the new -L command line option
> to name the log files.  Once the second snort is running you can kill
> the first snort by sending a signal to the saved PID. Yes, there will
> be some overlap in packet capturing between the two but if you
> absolutely can't miss any packets then this seems to be the approach
> to take.
>
> -- 
> Johannes "John" Grosen, M.S., Assoc. Dir.     NDHECN South Host Site
> Information Technology Services                       http://www.nodak.edu/
> North Dakota State University                 http://www.ndsu.nodak.edu/
> Fargo, ND 58105-5164                          (701) 231-1042

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users