From owner-freebsd-questions  Thu Mar 22 15:57:39 2001
Delivered-To: freebsd-questions@freebsd.org
Received: from femail1.rdc1.on.home.com (femail1.rdc1.on.home.com [24.2.9.88])
	by hub.freebsd.org (Postfix) with ESMTP id 89A0137B71F
	for <freebsd-questions@FreeBSD.ORG>; Thu, 22 Mar 2001 15:57:37 -0800 (PST)
	(envelope-from latif2221@home.com)
Received: from home.com ([24.114.36.13]) by femail1.rdc1.on.home.com
          (InterMail vM.4.01.03.20 201-229-121-120-20010223) with ESMTP
          id <20010322235611.DZGP14290.femail1.rdc1.on.home.com@home.com>
          for <freebsd-questions@FreeBSD.ORG>;
          Thu, 22 Mar 2001 15:56:11 -0800
Message-ID: <3ABA8DE6.86C921A1@home.com>
Date: Thu, 22 Mar 2001 18:42:31 -0500
From: Duraid <latif2221@home.com>
X-Mailer: Mozilla 4.76 [en] (X11; U; Linux 2.2.12 i386)
X-Accept-Language: en
MIME-Version: 1.0
To: "freebsd-questions@FreeBSD.ORG" <freebsd-questions@FreeBSD.ORG>
Subject: snort administration
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

im using snort -b -L snort.log to get the fastest performance and the
most details. and am running a cron job to extact the details from the
binary file snort.log: snort -vde ....... -r snort.log.
the problem is, when the snort done extracing the information from the
binary file it doesn't clean my snort.log binary to log new
information... so when i run snort -r snort it will give the old plus
the new information. i tried using
# echo  -n "" >  snort.log to empty it so  that it logs only the new
info... but snort -r snort.log refuses to read it and exists with an
error saying bad dump file. any idea?

Duraid


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message