SNORT：如何将日志文件保存为ASCII格式？
我用这个命令捕获了流量 /usr/loca/bin/snort -ieth0 -l /var/log/snort 因为我从来没有把 -b 放在后面，所以它不是二进制文件.. 但是当我编写一个程序来读取日志文件时，似乎显示所有未知单词...所以这意味着它仍然是一个二进制文件仪式... 还有其他方法可以指定它必须是 ASCII 格式吗？ 比如需要在 snort.conf 上配置或者其他？
I'm captured the traffic with this command
/usr/loca/bin/snort -ieth0 -l /var/log/snort
since behind i never put -b so it's not binary file..
but when i write a program to read the log file seem like display all unknown word...so it's mean it still a binary file rite...
any other method to specify it must be ASCII format?
like need to configure on snort.conf or else?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您可以使用snort -A console -c /etc/snort/snort.conf -l /var/log/snort/ -K ascii
You can use
snort -A console -c /etc/snort/snort.conf -l /var/log/snort/ -K ascii大多数应用程序读取二进制日志格式。同样出于性能原因，二进制格式是首选。我只需记录到统一的日志格式，并使用 barnyard 将日志即时转换为文本。这将使您能够灵活地使用二进制日志和文本。
Most applications read the binary log format. Also for performance reasons the binary format is preferred. I would simply log to the unified log format and use barnyard to convert the logs to text on the fly. This will allow you the flexibility of having binary logs as well as text.
或者，您可以从 snort 配置启用基于 ASCII 的内置系统日志支持：
在 /etc/snort/snort.conf 中：
输出alert_syslog: host=dest_ip:dest_port, LOG_USER LOG_DEBUG LOG_PERROR
这将在/var/log/messages中生成syslog:
11/02-20:54:28.404290 [] [1:478:2] sig_name_p80 [】【分类：潜在不良流量】【优先级：5
] {TCP} 172.30.1.248:63880 --> 172.30.2.69:30002
11/02-20:54:28.404330 [] [1:478:2] sig_name_p80 [] [分类：潜在不良流量] [优先级：5
] {TCP} 172.30.2.69:30002 -> 172.30.1.248:63880
Alternatively, you may enable ASCII based inbuild syslog support from snort configuration:
in /etc/snort/snort.conf:
output alert_syslog: host=dest_ip:dest_port, LOG_USER LOG_DEBUG LOG_PERROR
This will intern generates syslog in /var/log/messages:
11/02-20:54:28.404290 [] [1:478:2] sig_name_p80 [] [Classification: Potentially Bad Traffic] [Priority: 5
] {TCP} 172.30.1.248:63880 -> 172.30.2.69:30002
11/02-20:54:28.404330 [] [1:478:2] sig_name_p80 [] [Classification: Potentially Bad Traffic] [Priority: 5
] {TCP} 172.30.2.69:30002 -> 172.30.1.248:63880