LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Non-*NIX Forums > Programming
User Name
Password
Programming This forum is for all programming questions.
The question does not have to be directly related to Linux and any language is fair game.

Notices


Reply
  Search this Thread
Old 11-27-2010, 03:56 AM   #31
grail
LQ Guru
 
Registered: Sep 2009
Location: Perth
Distribution: Manjaro
Posts: 10,008

Rep: Reputation: 3193Reputation: 3193Reputation: 3193Reputation: 3193Reputation: 3193Reputation: 3193Reputation: 3193Reputation: 3193Reputation: 3193Reputation: 3193Reputation: 3193

I know you are new to scripting but you really need to do some trialling of your own.
What I mean is, try running the following:
Code:
cat alertpause | wc -l | echo alertlog
At the command prompt and see what actually happens??

The way scripting works is we are trying to implement a solution that would be run by hand and take a long time to do manually.
So essentially anything you can do on the command line is then used in your script as an entry.

Hence your question:
Quote:
#how to run python program in here ? calling python maybe ?
My answer would be, how do you run it on the command line?
 
Old 11-27-2010, 06:59 AM   #32
andrapgm03
Member
 
Registered: Nov 2010
Location: Indonesia, jakarta
Distribution: Ubuntu Desktop 10.10
Posts: 32

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by grail View Post
I know you are new to scripting but you really need to do some trialling of your own.
What I mean is, try running the following:
Code:
cat alertpause | wc -l | echo alertlog
At the command prompt and see what actually happens??

The way scripting works is we are trying to implement a solution that would be run by hand and take a long time to do manually.
So essentially anything you can do on the command line is then used in your script as an entry.

Hence your question:
cat alertpause | wc -l will print 'how many lines in alertpause log files' then in my case it would be printed 4, I still didn't get it in echo alertlog, cause when I ran 'cat alertpause | wc -l | echo alertlog' it will just print alertlog, without showing how many lines in alertpause.

Yeah, I'm currently new in bash scripting
now, I tried using tail but the printed log was didn't like what I expected.

Quote:
Originally Posted by grail View Post
My answer would be, how do you run it on the command line?
just type python smsgateway.py "cell phone number" "message"
here python "message" parameter should read from alertpause then sent the last information about attack log files.
 
Old 11-28-2010, 11:38 AM   #33
andrapgm03
Member
 
Registered: Nov 2010
Location: Indonesia, jakarta
Distribution: Ubuntu Desktop 10.10
Posts: 32

Original Poster
Rep: Reputation: 0
I believe that /var/log/snort always logging a new alert if there is an intrusion or an attack, I wonder how to make the earlier bash script to running in daemon mode, it will logging every new file in /var/log/snort then printed out in new file called alertpause. This is the real goal of my idea.

Now I'm using swatch to tail every new file in /var/log/snort/alert, and it works great, but the log file is too much complicated and I need a new file a little bit easier to read so I used the the previous bash script, and it works great again..thanx...but now I'm going deeper and can't sleep to think about my curiosity. Here, I got a new idea to start tailing alertpause with swatch but it nothing happens, cause I should running bash parsetext.sh every time to make itu logged on alertpause..

I wonder how to make it keep always read /var/log/snort/alert automatically which the last line of the alert will be printed out in alertpause, so the alertpause will be kept on updating the log, each time snort got an attack/intrusion ?
 
Old 11-28-2010, 01:35 PM   #34
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Quote:
Originally Posted by andrapgm03 View Post
here's parameter what I want;
[kind of attack][the priority][time][source ip][destination ip]
It would be easier if you run Snort with "-A fast" as this creates single line alerts. As an exercise it's definitely nice to code a alerting app but why try to reinvent the wheel when there's apps around? Or don't Snort.org, Freshmeat or Sourceforge list one that seems usable to you?
 
Old 11-29-2010, 12:29 AM   #35
andrapgm03
Member
 
Registered: Nov 2010
Location: Indonesia, jakarta
Distribution: Ubuntu Desktop 10.10
Posts: 32

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by unSpawn View Post
It would be easier if you run Snort with "-A fast" as this creates single line alerts. As an exercise it's definitely nice to code a alerting app but why try to reinvent the wheel when there's apps around? Or don't Snort.org, Freshmeat or Sourceforge list one that seems usable to you?
yes that's good idea, I'm sorry if my mind still growing like a young kid in here, but I tried to learn the basic idea to do more development on my network system. I have read a lot about snort conf @ snort.org, and I haven't opened yet the freshmeat..thx for the idea..

Cheers.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Easy string/text manipulation/indentation for restructured text brianmcgee Linux - Software 1 04-22-2008 08:27 PM
Snort alert Problem bharathvn Linux - Security 9 11-21-2005 08:24 AM
snort alert and logging wilcsnyder Linux - Security 1 08-16-2004 07:08 PM
Snort alert / Am i attacking ? exalik Linux - Security 6 10-22-2003 03:55 PM
Snort Alert - What should I do? tarballedtux Linux - Security 1 04-06-2002 05:26 AM

LinuxQuestions.org > Forums > Non-*NIX Forums > Programming

All times are GMT -5. The time now is 06:19 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration