Discussion Locked

Automatically email Snort logs

0 helpful
5 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have Snort 1.8.7 running on a Red Hat 7.3 box at a customer site. The network administrator is not knowledgeable in security related issues, especially intrusion detection signatures. Is there a software package or plugin that I can use to automatically email Snort alerts to my Inbox so that I can analyze them in realtime? PLEASE HELP ME!!! *smile*

5 replies

by joematus

The only way I know to do this is to log your alerts to syslog. Then you need some program that looks at your syslog file periodically such as logcheck or swatch, which are freely available. Step by step instructions for logging to syslog can be found at:
http://www.snort.org/docs/faq.html#5.8

by vypre

Hi,

I have done quite a bit of work with snort and had the same need.

You probibly don't want to have the actual log files emailed to you because they are fairly hard to read. I used an application called snortsnarf to generate HTML summaries of the logs (which are pretty good).

The command that you want to do (this is just for one file, but you can apply it to any) is:

cat "logfile" | mail "email address"

eg. cat /var/log/snort/alert | mail me@domain.com

Hope this helps, if you need further information feel free to email me vypre@completeit.nu

This discussion is closed to new replies.