Re: Does snortsnarf work?

At 7:26 AM -0600 2/13/03, Schmehl, Paul L wrote:
>I've been running snortsnarf with this command:
>
>/usr/local/bin/snortsnarf -d /usr/local/www/snortsnarf/ -homenet
>x.x.x.x/16 -maxtime=yesterday snort:xxxxxx@snort@localhost  (IP and
>password obfuscated)
>
>But it has never worked.  I've let it run as long as 2 hours, and it
>never writes anything to the hard drive.  Last night I ran it through
>cron, figuring I'd just let it run until it finished.  It ran, and there
>are no errors in /var/log/cron or messages, but there's no data in the
>web directory either.
>
>What the heck am I doing wrong?

Try running it from the command line and observe its memory and CPU 
use.  If these increase, it is working on processing alerts.  If 
there are alot of alerts to process, SnortSnarf can take a while. 
But it should eventually complete successfully.

Let us know what you find.

Best regards,

   Jim
-- 
|*     Jim Hoagland, Associate Researcher, Silicon Defense     *|
|*    --- Silicon Defense: The Cyberwar Defense Company ---    *|
|*   [email protected], http://www.silicondefense.com/    *|
|*  Voice: (530) 756-7317                 Fax: (530) 756-7297  *|