aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--config/snort/snort_check_cron_misc.inc135
1 files changed, 83 insertions, 52 deletions
diff --git a/config/snort/snort_check_cron_misc.inc b/config/snort/snort_check_cron_misc.inc
index 038a11cd..7b0cfe34 100644
--- a/config/snort/snort_check_cron_misc.inc
+++ b/config/snort/snort_check_cron_misc.inc
@@ -1,10 +1,11 @@
<?php
/*
- * snort_chk_log_dir_size.php
+ * snort_check_cron_misc.inc
* part of pfSense
*
- * Modified for the Pfsense snort package v. 1.8+
+ * Modified for the pfSense snort package v. 1.8+
* Copyright (C) 2009-2010 Robert Zelaya Developer
+ * Copyright (C) 2014 Bill Meeks
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -31,68 +32,98 @@
require_once("/usr/local/pkg/snort/snort.inc");
-// 'B' => 1,
-// 'KB' => 1024,
-// 'MB' => 1024 * 1024,
-// 'GB' => 1024 * 1024 * 1024,
-// 'TB' => 1024 * 1024 * 1024 * 1024,
-// 'PB' => 1024 * 1024 * 1024 * 1024 * 1024,
+$snortlogdir = SNORTLOGDIR;
+function snort_check_dir_size_limit($snortloglimitsize) {
-/* chk if snort log dir is full if so clear it */
-$snortloglimit = $config['installedpackages']['snortglobal']['snortloglimit'];
-$snortloglimitsize = $config['installedpackages']['snortglobal']['snortloglimitsize'];
+ /********************************************************
+ * This function checks the total size of the Snort *
+ * logging sub-directory structure and prunes the files *
+ * for all Snort interfaces if the size exceeds the *
+ * passed limit. *
+ * *
+ * On Entry: $snortloglimitsize = dir size limit in *
+ * in megabytes *
+ ********************************************************/
-if ($g['booting']==true)
- return;
+ global $g, $config;
-if ($snortloglimit == 'off')
- return;
+ // Convert Log Limit Size setting from MB to KB
+ $snortloglimitsizeKB = round($snortloglimitsize * 1024);
+ $snortlogdirsizeKB = snort_Getdirsize(SNORTLOGDIR);
+ if ($snortlogdirsizeKB > 0 && $snortlogdirsizeKB > $snortloglimitsizeKB) {
+ log_error(gettext("[Snort] Log directory size exceeds configured limit of " . number_format($snortloglimitsize) . " MB set on Global Settings tab. All Snort log files will be truncated."));
+ conf_mount_rw();
-if (!is_array($config['installedpackages']['snortglobal']['rule']))
- return;
+ // Truncate the Rules Update Log file if it exists
+ if (file_exists(RULES_UPD_LOGFILE)) {
+ log_error(gettext("[Snort] Truncating the Rules Update Log file..."));
+ file_put_contents(RULES_UPD_LOGFILE, "");
+ }
-/* Convert Log Limit Size setting from MB to KB */
-$snortloglimitsizeKB = round($snortloglimitsize * 1024);
-$snortlogdirsizeKB = snort_Getdirsize(SNORTLOGDIR);
-if ($snortlogdirsizeKB > 0 && $snortlogdirsizeKB > $snortloglimitsizeKB) {
- log_error(gettext("[Snort] Log directory size exceeds configured limit of " . number_format($snortloglimitsize) . " MB set on Global Settings tab. All Snort log files will be truncated."));
- conf_mount_rw();
-
- /* Truncate the Rules Update Log file if it exists */
- if (file_exists(RULES_UPD_LOGFILE)) {
- log_error(gettext("[Snort] Truncating the Rules Update Log file..."));
- $fd = @fopen(RULES_UPD_LOGFILE, "w+");
- if ($fd)
- fclose($fd);
- }
+ // Clean-up the logs for each configured Snort instance
+ foreach ($config['installedpackages']['snortglobal']['rule'] as $value) {
+ $if_real = get_real_interface($value['interface']);
+ $snort_uuid = $value['uuid'];
+ $snort_log_dir = SNORTLOGDIR . "/snort_{$if_real}{$snort_uuid}";
+ log_error(gettext("[Snort] Truncating logs for {$value['descr']} ({$if_real})..."));
+ snort_post_delete_logs($snort_uuid);
+
+ // Truncate the alert log file if it exists
+ if (file_exists("{$snort_log_dir}/alert")) {
+ file_put_contents("{$snort_log_dir}/alert", "");
+ }
- /* Clean-up the logs for each configured Snort instance */
- foreach ($config['installedpackages']['snortglobal']['rule'] as $value) {
- $if_real = snort_get_real_interface($value['interface']);
- $snort_uuid = $value['uuid'];
- $snort_log_dir = SNORTLOGDIR . "/snort_{$if_real}{$snort_uuid}";
- log_error(gettext("[Snort] Truncating logs for {$value['descr']} ({$if_real})..."));
- snort_post_delete_logs($snort_uuid);
-
- /* Truncate the alert log file if it exists */
- if (file_exists("{$snort_log_dir}/alert")) {
- $fd = @fopen("{$snort_log_dir}/alert", "w+");
- if ($fd)
- fclose($fd);
+ // This is needed if snort is run as snort user
+ mwexec('/bin/chmod 660 {$snort_log_dir}/*', true);
+
+ // Soft-restart Snort process to resync logging
+ if (file_exists("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid")) {
+ log_error(gettext("[Snort] Restarting logging on {$value['descr']} ({$if_real})..."));
+ mwexec("/bin/pkill -HUP -F {$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid -a");
+ }
}
+ conf_mount_ro();
+ log_error(gettext("[Snort] Automatic clean-up of Snort logs completed."));
+ }
+}
+
+/*************************
+ * Start of main code *
+ *************************/
+
+// If firewall is booting, do nothing
+if ($g['booting'] == true)
+ return;
- /* This is needed if snort is run as snort user */
- mwexec('/bin/chmod 660 /var/log/snort/*', true);
+// If no interfaces defined, there is nothing to clean up
+if (!is_array($config['installedpackages']['snortglobal']['rule']))
+ return;
- /* Soft-restart Snort process to resync logging */
- if (file_exists("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid")) {
- log_error(gettext("[Snort] Restarting logging on {$value['descr']} ({$if_real})..."));
- mwexec("/bin/pkill -HUP -F {$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid -a");
+// Check unified2 archived log retention in the interface logging directories if enabled
+foreach ($config['installedpackages']['snortglobal']['rule'] as $value) {
+ $if_real = get_real_interface($value['interface']);
+ $snort_log_dir = SNORTLOGDIR . "/snort_{$if_real}{$value['uuid']}";
+ if (is_dir("{$snort_log_dir}/barnyard2/archive") && $value['u2_archived_log_retention'] > 0) {
+ $now = time();
+ $files = glob("{$snort_log_dir}/barnyard2/archive/snort_{$value['uuid']}_{$if_real}.u2.*");
+ $prune_count = 0;
+ foreach ($files as $f) {
+ if (($now - filemtime($f)) > ($value['u2_archived_log_retention'] * 3600)) {
+ $prune_count++;
+ unlink_if_exists($f);
+ }
}
+ unset($files);
+ if ($prune_count > 0)
+ log_error(gettext("[Snort] Barnyard2 archived logs cleanup job removed {$prune_count} file(s)..."));
}
- conf_mount_ro();
- log_error(gettext("[Snort] Automatic clean-up of Snort logs completed."));
}
+// Check the overall log directory limit (if enabled) and prune if necessary
+if ($config['installedpackages']['snortglobal']['snortloglimit'] == 'on')
+ snort_check_dir_size_limit($config['installedpackages']['snortglobal']['snortloglimitsize']);
+
+return;
+
?>