RE: How to enable mail notication?

["Glenn E. Bailey III" <gbailey () sprocketdata com>]

Here is a quick and really dirty script I run, you have
to setup snort to log via syslog and setup syslog to log
snort alerts to a seperate file .. Only good if you have
a small site really, and like I said, it's dirty:

#!/usr/bin/perl

use strict;

my $snort_log     = '/var/log/snort.log'; # location of snort.log generated
by syslog
my $snort_log_old = '/var/log/snort/old/snort'; # path to dir where to store
old logs
my $notify_log    = '/var/log/snort/notify.log'; # path to log where to log
notifications
my $email         = 'youremail () blah com'; # guess what this is ;-)

open(SNORT_LOG, "$snort_log");

if (! <SNORT_LOG>) {
        exit();
        }

else {
        system("mail $email -s \"Snort alert\" < $snort_log");

        open(NOTIFY, ">>$notify_log");
        my $localtime = localtime();
        print NOTIFY "$localtime - Alert sent to $email\n";
        close NOTIFY;

        my $time = time();
        system("mv $snort_log $snort_log_old.$time");
        system("kill -SIGHUP \`cat /var/run/syslogd.pid\`");
        exit();
        }

-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net]On Behalf Of Erek Adams
Sent: Wednesday, January 23, 2002 9:50 AM
To: My Security
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] How to enable mail notication?


On Wed, 23 Jan 2002, My Security wrote:

> I would like to enable sending mail if there is alert
> on my email address.
>
> How will I be able to configure this option to the
> snort.conf.

You can't.

http://www.snort.org/docs/faq.html#5.7

Also read the users manual from the Documentation page.  The rest of the FAQ
won't hurt either....

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users