Re: Real-time email notification

[Blake Frantz <blake () mc net>]

I wrote my own that daemonizes and has a filtering option.  If the
contents of @Filter are matched in the alert line, it won't send the
email. It serves its purpose.

I tested it on Redhat and BSDi with PERL5.

-Blake

<code>
#!/usr/bin/perl

use IO::Handle;
use strict;

my $Sendmail = "/usr/sbin/sendmail";
my $LogFile  = "/var/log/snort/alert";
my @Filter   = qw("Destination Unreachable", "Time Exceeded");
my $Email    = "admin\@net.org";

#leave the rest alone.

my $CurPos   = "";
my $LogLine  = "";
my $MailIt   =  1;

my $PID      = fork;

exit if $PID;
die("Error.") unless defined($PID);

pipe(CHILDREAD, CHILDWRITE);
CHILDWRITE->autoflush(1);

if(fork()) {
 open(FILE,"$LogFile");
 for (;;) {
    for ($CurPos = tell(FILE); $_ = <FILE>;
       $CurPos = tell(FILE)) {
       print CHILDWRITE $_;
    }
    seek(FILE, $CurPos, 0);
    sleep(1);
 }
 close(FILE);
 exit(0)
}else {
   while(1) {
      $LogLine = <CHILDREAD>;
      foreach(@Filter){
         if($LogLine=~m/$_/){
            $MailIt = 0;
         }
      }
      if($MailIt) {
         open(MAIL,"|$Sendmail -t");
         print MAIL "To: $Email\n";
         print MAIL "From: SnortAlert\n";
         print MAIL "Subject: Snort Alert\n";
         print MAIL "\n$LogLine\n";
         close(MAIL);
      }
      $MailIt = 1;
   }
}
</code>


================================================================= 
The Government, like diapers, should be replaced regularly, and
often for the same reasons. 

On Tue, 3 Jul 2001, Michael Pickert wrote:

> Hi,
>
> can anybody tell me a way to check the snort-logfiles in real-time and send 
> a email to the  admin as a notificaiton of a alert? 
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users