Re: Snort3 Docker help

Vitalli,
The specific error is as follows:

FATAL: OpenAlertFile() => fopen() alert file /var/log/snort/alert_json.txt: Permission denies

I have 3 commands (as I was testing things to fix this) in my dockerfile:

RUN mkdir -p /var/log/snort

RUN chown snort:snort /var/log/snort

RUN chmod 777 /var/log/snort/

Those are the specific commands I have.

Thanks,

Nick
Sent from my iPhone

On Sep 22, 2023, at 09:13, Vitalii Serhiiovych Horbatov -X (vhorbato - SOFTSERVE INC at Cisco) <[email protected]> wrote:



Hi Nick, are you sure that
/var/log/snort/ directory exists in your container?

Try adding “RUN mkdir -p /var/log/snort/” to your Dockerfile.

This could also be permissions related, check if you are running in sudo.

Theoretically, you should see the reason for the error when snort cannot open the file. Example:

FATAL: OpenAlertFile() => fopen() alert file /var/log/snort/5_alert_full.txt: No such file or directory

Thanks,

Vitalii!

From:
Snort-users <[email protected]> on behalf of Nick Godwod via Snort-users <[email protected]>

Date: Thursday, 21 September 2023, 16:18

To: [email protected] <[email protected]>

Subject: [Snort-users] Snort3 Docker help

Howdie folks,

Working on getting Snort3 up and running in docker. Ive utilized what I can from various github and docker images, however Im having and issue with logging.

In my snort.lua I specify to log to an alert_json file.

At run time in the dockerfile, I have specificed “-l /var/log/snort” for alert log placement.

However, when running the docker container i get “FATAL:OpenAlertFile() => fopen() alert file /var/log/snort/alert_json.txt.

Ive tried to troubleshoot a couple different ways and I am unable to fix this issue.

Sent from my iPhone

_______________________________________________

Snort-users mailing list

[email protected]

Go to this URL to change user options or unsubscribe:

https://lists.snort.org/mailman/listinfo/snort-users

To unsubscribe, send an email to:

[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette