LinuxQuestions.org
Latest LQ Deal: Complete CCNA, CCNP & Red Hat Certification Training Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 05-26-2004, 04:41 PM   #1
zerocomm
LQ Newbie
 
Registered: May 2004
Posts: 1

Rep: Reputation: 0
Snort log rotation suggestions


Hi.

I run snort on my NIDS and I want to be able to rotate these log files every 3 months so I don't have extremely stale logs laying around. I already have a method to permanently back them up, so this is just to keep the directory coherent.

Snort logs are saved in /var/log/snort. This is what the contents of the directory lok like.

/var/log/snort contents:

(ip)xxx.xxx.x.xxx (ip)xxx.xxx.xxx.xx/ (ip)xxx.xxx.xxx.xxx/ alert
 
Old 05-26-2004, 11:23 PM   #2
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 69
Have you tried just using logrotate? Just create a file in the /etc/logrotate.d/ directory (you can name it snort). Then depending on what you want to do (check the logrotate man page), you can write a small script to handle the rotation. You can set it up to compress the alert file, move it to an archive, then wipe the contents of /var/log/snort, then make a new alert file and restart snort. Using the postrotate option to execute those commands as sort of a "mini-script" works well.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How to resolve log rotation error? sdebiasio Linux - Newbie 4 09-08-2004 03:48 AM
Webalizer With Log Rotation dmedici Linux - Software 0 08-17-2004 10:06 AM
manual log rotation will103 Linux - Newbie 2 04-20-2004 03:20 AM
disable log rotation in site krishn Linux - General 1 07-28-2003 08:53 AM
Log rotation - NewB nrastogi Linux - Software 1 02-12-2003 11:44 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 07:14 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration