Re: [Snort-users] I have deleted the file /var/log/snort/alert and

Hi,

if the file is still opened by Snort (check that with "lsof +L1"),
you may still be able to rescue it using the proc-fs.

Find out with which PID the Snort process is running: "pidof snort"
or "ps -ax | grep snort".

See under "/proc/*Snort-PID*/fd/*FD-number*" if you can find your alert
file. If you have lsof (list open files) you may find out, which
FD-number it have:

lsof -p `pidof snort` | grep alert
snort 3696 root 6w REG 3,3 2832839 164515 /var/log/snort/alert...

Where the columns are:
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME

So now do a (example here)
cat /proc/3696/fd/6 > /var/log/snort/alert_saved and you got your file
back. Rename the file to alerts again and restart Snort, since it will
continue to log to the old (deleted) alerts file.

If you restarted Snort in the meantime, you may check some links
handling computer forensics, hoping your file is still somewhere
on your HD and has not been overwritten yet.

Regards,
Edin


soldier Mx wrote:
> Hello! im here again with problems and.. as i was seeing that the
[...]


-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users