Re: Snort3 Docker help

Hi Nick, are you sure that /var/log/snort/ directory exists in your container?
Try adding “RUN mkdir -p /var/log/snort/” to your Dockerfile.

This could also be permissions related, check if you are running in sudo.

Theoretically, you should see the reason for the error when snort cannot open the file. Example:
FATAL: OpenAlertFile() => fopen() alert file /var/log/snort/5_alert_full.txt: No such file or directory

Thanks,
Vitalii!

From: Snort-users <[email protected]> on behalf of Nick Godwod via Snort-users <[email protected]>
Date: Thursday, 21 September 2023, 16:18
To: [email protected] <[email protected]>
Subject: [Snort-users] Snort3 Docker help
Howdie folks,

Working on getting Snort3 up and running in docker. Ive utilized what I can from various github and docker images, however Im having and issue with logging.

In my snort.lua I specify to log to an alert_json file.

At run time in the dockerfile, I have specificed “-l /var/log/snort” for alert log placement.

However, when running the docker container i get “FATAL:OpenAlertFile() => fopen() alert file /var/log/snort/alert_json.txt.

Ive tried to troubleshoot a couple different ways and I am unable to fix this issue.
Sent from my iPhone
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        [email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette