OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Adam VanderHook (avanderhookcapitol-college.edu)
Date: Tue Apr 10 2001 - 18:40:40 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    I've searched the archives but have been able to find anything that
    matches my situation. From rc.local I run snort (from the port tree) as
    follows:

    snort -D -l /var/log/snort/ -b -s

    As a result, I have various files in /var/log/snort/

    snort-04101921.log
    snort-04101934.log

    I need to rotate these files, but there names always differ. I've read
    through the newsyslog man page and have added the following to
    /etc/newsyslog.conf:

    #######################################################################
    # Snort
    /var/log/snort/snort-*.log 600 7 * 24 ZB /var/run/snort_dc0.pid

    Is this valid? I have been unable to find any documentation that states
    whether or not a wildcard like that is valid for the 'logfile name'
    field. 

    -- 
Adam VanderHook
acidosusers.sourceforge.net
http://www.capcol.edu/student/avanderhook/