I have Snort for Windows. I am trying to make a log file of say size limit 1MB. When the log file hits the 1MB maximum, I want it to close that file (snort.log.1234567890) and open a new log file instance (snort.log.1234567891) until that gets to the maximum, then make another log file instance (snort.log.1234567892). I should be able to take the now closed log files and read them back in and analyze them, as Snort continues to make new logs.

I tried to make such a size limit in the snort.conf file, with the size 1 (and no nostamp), which should make a unique snort.log.123456wxyz (timestamp extension).

I tried it to the snort.log.123..., the snort.alert.123..., the tcpdump.123... but have not been successful.

The results are either no timestamp extension, or does not limit the size to 1MB, and same file keeps growing and growing.


For snort3 you can do that by adding this line in the snort configuration file (snort.lua).

log_pcap = { limit = 1 }

Unfortunately, I haven't used snort 2 to tell you :(

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.