OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Jan Johansson (janj+openbsd_at_wenf.org)
Date: Tue Aug 06 2002 - 10:23:20 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    On Tue, Aug 06, 2002 at 04:13:46PM +0200, Han wrote:
    >Jan Johansson (janj+openbsdwenf.org) wrote:
    >>
    >> This is in my root crontab.
    >>
    >> 0 */6 * * * /usr/sbin/tcpdump -n -e -tttv -r /var/log/pflog | /usr/local/sbin/pf.pl
    >
    >Don't you get the problem that some logs are not send and others are send double?

    dshield keeps a timestamp on the last logline sent so a line is
    newer sent two times, from my config:

    # This file contains the date of the last submitted log entry.
    linecnt=/etc/dshield/linecnt

    But some line might not be sent. But it is not a big problem for
    me as my pflog is rotated once a week or so.