Security — Installing and monitoring snort logs.

2010-06-04 236 words 2 mins read

Snort is a very good security tool to install if you are concerned about the security of your system. I find it really useful but the problem is I keep forgetting to monitor the logs so what did I do, I installed snort and configured cron to send to logs everyday, here’s how.

On fedora, snort is available in the repository but the rules are not. So to install snort just type in the following in a terminal:

sudo yum install snort

Once this is done, we need to install the snort rules. Download the snort rules from <a href="" target="_blank">here. Extract the rules in /etc/snort/rules and you are done. Configure snort to start automatically using the system-config-service command or using any other way.

Now put a cron entry in the root user account to send the mail to any user at any time:

sudo crontab -e

add the following:

30 10 * * * cat /var/log/snort/alert |mail -s &#8221;Snort Logs `date`&#8221; && rm -f /var/log/snort/alert

Here I am using an alias to send the mail but you can use <a href="" target="_blank">sendEmail or <a href="" target="_blank">sendmail to do the same. Also note that I am deleting the file after sending the logs to make sure that next day I get only the fresh logs. Other option could be to mv it some other location with the datestamp. But that is completely up to you 🙂


Authored By Amit Agarwal

Amit Agarwal, Linux and Photography are my hobbies.Creative Commons Attribution 4.0 International License.

We notice you're using an adblocker. If you like our webite please keep us running by whitelisting this site in your ad blocker. We’re serving quality, related ads only. Thank you!

I've whitelisted your website.

Not now
This website uses cookies to ensure you get the best experience on our website. Learn more Got it