Parsing Snort Binary Files

[ahuang14]

Hello Monks,

I am logging alerts with Snort and making output files of them. I am wondering if there was a way for Perl to read that data continuously so I would never have to turn off Snort and have it keep logging to one file. I know there is a File::Tail but I do not think this works for binary, only for ascii.

Either Perl could parse as new alerts are writing to the output file or another option is rolling over the files every time Snort realizes there are x MB of data in them. Then Perl can parse a file xxx.log and change it to xxy.log, while there are files that are not xxy.log, then parse them.

Which option do you think is the most feasible?

[ikegami]

I know there is a File::Tail but I do not think this works for binary, only for ascii.

It shouldn't be hard to copy it and change it's definition of "line" to match a Snort log record.

[Illuminatus]

I took a quick look at the code, and it would be a little complicated, but not too bad. It does newline processing in lots of places, which you would have to change. However at its core it does sysreads to fill its buffer, so the type of data is immaterial. And look on the bright side: if you re-do it as File::Tail::Snort, you could have you very own package on cpan, and your name would live in infamy :)

fnord

[Anonymous Monk]

Haha this is my first ever work with Perl so it would probably be a big task for me to rewrite it, but I'll still still take a look.

I am left with a couple options so far: 1. Snort logs to a regular ascii file that will work with File::Tail 2. Snort logs to pcap binary files that can be one or multiple log files but for one file, I wouldn't be able to use a continuous file.

What my boss wants is to create a parsed log about every 24 hours with the data acquired. I guess to start off, would this be better to implement on one continuous log? or would it be better to lets say, tell Snort to stop once the file is xx MB and then parse each of those?

I am not really sure how to approach this problem as you can see. There are a couple options but I cant determine which road to take.