Re: [Snort-users] snort_stat.pl

Thanks Stephane, the file is only around 25 MB though!?

Regards

Rob

--On 20 October 2004 17:07 +0200 stephane nasdrovisky
<stephane.nasdrovisky@paradigmo.com> wrote:

> Rob Ward wrote:
>
>> Perl 5.6
>> snort_stat.pl 1.15.2.6
>>
>> When I run the 'alert' file produced by Snort through snort_stat.pl it
>> doesn't produce any data yet the file is full of alerts. I've seen
>> others with similar problems in the archives. Has anyone resolved this?
>>
>> The strange thing is I also use grep to produce a file of DOS and DDOS
>> alerts from the 'alert' file and when I run this through snort_stat.pl
>> this produces output?
>
> Is your alert file larger than 2gb ? It may be related to some
> restriction on the file size (2 or 4 gb, I can't remember). If grep is
> producing a file smaller than 2gb, game is over. You may upgrade your
> perl to an uptodate one 5.8? It seems perl 5.6.1 is largefile (>2 or 4
> gb) ready. Google for "perl largefile" for more info.



Rob Ward
Network Northwest Support
University of Liverpool
Computing Services Department

Tel: 0151 794 4449
Fax: 0151 794 4442
Mob: 07970 247 326


-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjourna...uidepromo.tmpl
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users