I have Snort for Windows. I am trying to make a log file of say size limit 1MB. When the log file hits the 1MB maximum, I want it to close that file (snort.log.1234567890) and open a new log file instance (snort.log.1234567891) until that gets to the maximum, then make another log file instance (snort.log.1234567892). I should be able to take the now closed log files and read them back in and analyze them, as Snort continues to make new logs.
I tried to make such a size limit in the snort.conf file, with the size 1 (and no nostamp), which should make a unique snort.log.123456wxyz (timestamp extension).
I tried it to the snort.log.123..., the snort.alert.123..., the tcpdump.123... but have not been successful.
The results are either no timestamp extension, or does not limit the size to 1MB, and same file keeps growing and growing.