/etc/cron.daily/5snort is in snort-common 2.9.7.0-5.
This file is owned by root:root, with mode 0o755.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 | #!/bin/sh -e
test -f /usr/sbin/snort || exit 0
LOGFILE=/var/log/snort/alert
PATH=/bin:/usr/bin:/sbin:/usr/sbin
CONFIG=/etc/snort/snort.debian.conf
. $CONFIG
# Don't generate stats if we are configured not to
[ "$DEBIAN_SNORT_SEND_STATS" = "false" ] && exit 0
export DEBIAN_SNORT_STATS_RCPT DEBIAN_SNORT_STATS_THRESHOLD
# Just in case it's not properly configured for whatever reason
[ -z "$DEBIAN_SNORT_STATS_THRESHOLD" ] && DEBIAN_SNORT_STATS_THRESHOLD=1
[ -z "$DEBIAN_SNORT_STATS_RCPT" ] && DEBIAN_SNORT_STATS_RCPT=root
# Cannot use logrotate to rotate these logfiles...
# 'rotate' saved RAW-Ethernet streams
# New snort has different naming scheme, old one still here for upgrades
find /var/log/snort -name "snort-*@*.log" -mtime +15 | xargs --no-run-if-empty rm
find /var/log/snort -name "tcpdump.log.*" -mtime +15 | xargs --no-run-if-empty rm
find /var/log/snort -name "snort.log.*" -mtime +15 | xargs --no-run-if-empty rm
# Mail snort stats
if [ -s $LOGFILE ]; then
(echo "To: $DEBIAN_SNORT_STATS_RCPT"; snort-stat -a -t $DEBIAN_SNORT_STATS_THRESHOLD < $LOGFILE) | sendmail -t
fi
# Restarting snort is now handled by the logrotate configuration.
# The 'intelligence' of not to start in certain startup-modes moved
# to the init.d script as well.
exit 0
|