Re: I have deleted the file /var/log/snort/alert and i dont see snort writing on it now.

[Edin Dizdarevic <Edin.Dizdarevic () interActive-Systems de>]

Hi,

if the file is still opened by Snort (check that with "lsof +L1"),
you may still be able to rescue it using the proc-fs.

Find out with which PID the Snort process is running: "pidof snort"
or "ps -ax | grep snort".

See under "/proc/*Snort-PID*/fd/*FD-number*" if you can find your alert
file. If you have lsof (list open files) you may find out, which 
FD-number it have:

lsof -p `pidof snort` | grep alert
snort   3696 root    6w   REG    3,3 2832839  164515 /var/log/snort/alert...

Where the columns are:
COMMAND  PID USER   FD   TYPE DEVICE    SIZE    NODE NAME

So now do a (example here)
cat /proc/3696/fd/6 > /var/log/snort/alert_saved and you got your file
back. Rename the file to alerts again and restart Snort, since it will
continue to log to the old (deleted) alerts file.

If you restarted Snort in the meantime, you may check some links
handling computer forensics, hoping your file is still somewhere
on your HD and has not been overwritten yet.

Regards,
Edin


soldier Mx wrote:
> Hello! im here again with problems and.. as i was seeing that the
[...]


-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users