Re: Snort3 Docker help

Hi Nick,

Had the same error because the files were created with incorrect permissions, solve the issue to set the default ACL RW on the dockerfile via setfacl.
You could check if you have the same issue with a « ls -l /var/log/snort/ ».

Thanks,
Baptiste

De : Snort-users <[email protected]> De la part de Nick Godwod via Snort-users
Envoyé : vendredi, 22 septembre 2023 18:50
À : Vitalii Serhiiovych Horbatov -X (vhorbato - SOFTSERVE INC at Cisco) <[email protected]>
Cc : [email protected]
Objet : Re: [Snort-users] Snort3 Docker help

Mail externe

Vitalli,
The specific error is as follows:



FATAL: OpenAlertFile() => fopen() alert file /var/log/snort/alert_json.txt: Permission denies


 I have 3 commands (as I was testing things to fix this) in my dockerfile:
RUN mkdir -p /var/log/snort
RUN chown snort:snort /var/log/snort
RUN chmod 777 /var/log/snort/

Those are the specific commands I have.

Thanks,
Nick
Sent from my iPhone


On Sep 22, 2023, at 09:13, Vitalii Serhiiovych Horbatov -X (vhorbato - SOFTSERVE INC at Cisco) <[email protected]<mailto:[email protected]>> wrote:


Hi Nick, are you sure that /var/log/snort/ directory exists in your container?
Try adding “RUN mkdir -p /var/log/snort/” to your Dockerfile.

This could also be permissions related, check if you are running in sudo.

Theoretically, you should see the reason for the error when snort cannot open the file. Example:
FATAL: OpenAlertFile() => fopen() alert file /var/log/snort/5_alert_full.txt: No such file or directory

Thanks,
Vitalii!



From: Snort-users <[email protected]<mailto:[email protected]>> on behalf of Nick Godwod via Snort-users <[email protected]<mailto:[email protected]>>
Date: Thursday, 21 September 2023, 16:18
To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>>
Subject: [Snort-users] Snort3 Docker help

Howdie folks,

Working on getting Snort3 up and running in docker. Ive utilized what I can from various github and docker images, however Im having and issue with logging.

In my snort.lua I specify to log to an alert_json file.

At run time in the dockerfile, I have specificed “-l /var/log/snort” for alert log placement.

However, when running the docker container i get “FATAL:OpenAlertFile() => fopen() alert file /var/log/snort/alert_json.txt.

Ive tried to troubleshoot a couple different ways and I am unable to fix this issue.
Sent from my iPhone
_______________________________________________
Snort-users mailing list
[email protected]<mailto:[email protected]>
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        [email protected]<mailto:[email protected]>

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
_______________________________________________
Snort-users mailing list
[email protected]<mailto:[email protected]>
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        [email protected]<mailto:[email protected]>

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette