Snort init script `stats` function

The current `stats` function in the init.d script has been very unreliable
for me, due to variations in the `startdate` variable recorded in the
script and the timestamp when the log lines are actually written by snort.

Accordingly I have modified my init script to use the following:

    tac /var/log/messages | grep -m1 '*** Caught Dump Stats-Signal' -B147 |
tac | grep snort.*: | cut -d: -f4-

This example of the basic `stats` function does the following:

1. Uses `tac` to reverse the order of `$SYSLOG`
2. Greps for the first occurrence of the snort stats start signature and
includes an additional 147 lines of output
3. Reverses the order (again using `tac`) to return it to normal order
4. Filters out any non-snort lines

I think this is a more reliable approach. The only risk is if the stats
aren't dumped correctly it could return an earlier collection of
statistics, however I feel this is highly unlikely.

I looked for a public repository to provide a diff or pull request but
could not find any.

Please let me know if you think this is suitable for inclusion for future
releases.

Regards,

Peter

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!