Re: Snort daily reports

["Dave Rutherford" <dave () evilpettingzoo com>]

On 1/4/07, Dave Rutherford <dave () evilpettingzoo com> wrote:
> On 1/3/07, info+lucretia.ca <info () lucretia ca> wrote:
> > Snort daily reports?  What tool is this?
> >
> > Snort has no email or reporting functions.
>
> That's a fair question; I've no idea.  As I said, I'm using the
> Debian packages, and I don't have anything installed with
> a name remotely like 'snort-reporter'.

Found it.  Debian's cron packaging leaves some things to
be desired, but there's a script in /etc/cron.daily/5snort
containing:

   (echo "To: $DEBIAN_SNORT_STATS_RCPT"; snort-stat -a -t
$DEBIAN_SNORT_STATS_THRESHOLD < $LOGFILE) | sendmail -t

(LOGFILE being defined as LOGFILE=/var/log/snort/alert)

Apparently this file is never pruned.  Could anybody tell me why?

Dave

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users