diff options
| -rw-r--r-- | config/snort/snort_check_cron_misc.inc | 135 |
1 files changed, 83 insertions, 52 deletions
diff --git a/config/snort/snort_check_cron_misc.inc b/config/snort/snort_check_cron_misc.inc index 038a11cd..7b0cfe34 100644 --- a/config/snort/snort_check_cron_misc.inc +++ b/config/snort/snort_check_cron_misc.inc @@ -1,10 +1,11 @@ <?php /* - * snort_chk_log_dir_size.php + * snort_check_cron_misc.inc * part of pfSense * - * Modified for the Pfsense snort package v. 1.8+ + * Modified for the pfSense snort package v. 1.8+ * Copyright (C) 2009-2010 Robert Zelaya Developer + * Copyright (C) 2014 Bill Meeks * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -31,68 +32,98 @@ require_once("/usr/local/pkg/snort/snort.inc"); -// 'B' => 1, -// 'KB' => 1024, -// 'MB' => 1024 * 1024, -// 'GB' => 1024 * 1024 * 1024, -// 'TB' => 1024 * 1024 * 1024 * 1024, -// 'PB' => 1024 * 1024 * 1024 * 1024 * 1024, +$snortlogdir = SNORTLOGDIR; +function snort_check_dir_size_limit($snortloglimitsize) { -/* chk if snort log dir is full if so clear it */ -$snortloglimit = $config['installedpackages']['snortglobal']['snortloglimit']; -$snortloglimitsize = $config['installedpackages']['snortglobal']['snortloglimitsize']; + /******************************************************** + * This function checks the total size of the Snort * + * logging sub-directory structure and prunes the files * + * for all Snort interfaces if the size exceeds the * + * passed limit. * + * * + * On Entry: $snortloglimitsize = dir size limit in * + * in megabytes * + ********************************************************/ -if ($g['booting']==true) - return; + global $g, $config; -if ($snortloglimit == 'off') - return; + // Convert Log Limit Size setting from MB to KB + $snortloglimitsizeKB = round($snortloglimitsize * 1024); + $snortlogdirsizeKB = snort_Getdirsize(SNORTLOGDIR); + if ($snortlogdirsizeKB > 0 && $snortlogdirsizeKB > $snortloglimitsizeKB) { + log_error(gettext("[Snort] Log directory size exceeds configured limit of " . number_format($snortloglimitsize) . " MB set on Global Settings tab. All Snort log files will be truncated.")); + conf_mount_rw(); -if (!is_array($config['installedpackages']['snortglobal']['rule'])) - return; + // Truncate the Rules Update Log file if it exists + if (file_exists(RULES_UPD_LOGFILE)) { + log_error(gettext("[Snort] Truncating the Rules Update Log file...")); + file_put_contents(RULES_UPD_LOGFILE, ""); + } -/* Convert Log Limit Size setting from MB to KB */ -$snortloglimitsizeKB = round($snortloglimitsize * 1024); -$snortlogdirsizeKB = snort_Getdirsize(SNORTLOGDIR); -if ($snortlogdirsizeKB > 0 && $snortlogdirsizeKB > $snortloglimitsizeKB) { - log_error(gettext("[Snort] Log directory size exceeds configured limit of " . number_format($snortloglimitsize) . " MB set on Global Settings tab. All Snort log files will be truncated.")); - conf_mount_rw(); - - /* Truncate the Rules Update Log file if it exists */ - if (file_exists(RULES_UPD_LOGFILE)) { - log_error(gettext("[Snort] Truncating the Rules Update Log file...")); - $fd = @fopen(RULES_UPD_LOGFILE, "w+"); - if ($fd) - fclose($fd); - } + // Clean-up the logs for each configured Snort instance + foreach ($config['installedpackages']['snortglobal']['rule'] as $value) { + $if_real = get_real_interface($value['interface']); + $snort_uuid = $value['uuid']; + $snort_log_dir = SNORTLOGDIR . "/snort_{$if_real}{$snort_uuid}"; + log_error(gettext("[Snort] Truncating logs for {$value['descr']} ({$if_real})...")); + snort_post_delete_logs($snort_uuid); + + // Truncate the alert log file if it exists + if (file_exists("{$snort_log_dir}/alert")) { + file_put_contents("{$snort_log_dir}/alert", ""); + } - /* Clean-up the logs for each configured Snort instance */ - foreach ($config['installedpackages']['snortglobal']['rule'] as $value) { - $if_real = snort_get_real_interface($value['interface']); - $snort_uuid = $value['uuid']; - $snort_log_dir = SNORTLOGDIR . "/snort_{$if_real}{$snort_uuid}"; - log_error(gettext("[Snort] Truncating logs for {$value['descr']} ({$if_real})...")); - snort_post_delete_logs($snort_uuid); - - /* Truncate the alert log file if it exists */ - if (file_exists("{$snort_log_dir}/alert")) { - $fd = @fopen("{$snort_log_dir}/alert", "w+"); - if ($fd) - fclose($fd); + // This is needed if snort is run as snort user + mwexec('/bin/chmod 660 {$snort_log_dir}/*', true); + + // Soft-restart Snort process to resync logging + if (file_exists("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid")) { + log_error(gettext("[Snort] Restarting logging on {$value['descr']} ({$if_real})...")); + mwexec("/bin/pkill -HUP -F {$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid -a"); + } } + conf_mount_ro(); + log_error(gettext("[Snort] Automatic clean-up of Snort logs completed.")); + } +} + +/************************* + * Start of main code * + *************************/ + +// If firewall is booting, do nothing +if ($g['booting'] == true) + return; - /* This is needed if snort is run as snort user */ - mwexec('/bin/chmod 660 /var/log/snort/*', true); +// If no interfaces defined, there is nothing to clean up +if (!is_array($config['installedpackages']['snortglobal']['rule'])) + return; - /* Soft-restart Snort process to resync logging */ - if (file_exists("{$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid")) { - log_error(gettext("[Snort] Restarting logging on {$value['descr']} ({$if_real})...")); - mwexec("/bin/pkill -HUP -F {$g['varrun_path']}/snort_{$if_real}{$snort_uuid}.pid -a"); +// Check unified2 archived log retention in the interface logging directories if enabled +foreach ($config['installedpackages']['snortglobal']['rule'] as $value) { + $if_real = get_real_interface($value['interface']); + $snort_log_dir = SNORTLOGDIR . "/snort_{$if_real}{$value['uuid']}"; + if (is_dir("{$snort_log_dir}/barnyard2/archive") && $value['u2_archived_log_retention'] > 0) { + $now = time(); + $files = glob("{$snort_log_dir}/barnyard2/archive/snort_{$value['uuid']}_{$if_real}.u2.*"); + $prune_count = 0; + foreach ($files as $f) { + if (($now - filemtime($f)) > ($value['u2_archived_log_retention'] * 3600)) { + $prune_count++; + unlink_if_exists($f); + } } + unset($files); + if ($prune_count > 0) + log_error(gettext("[Snort] Barnyard2 archived logs cleanup job removed {$prune_count} file(s)...")); } - conf_mount_ro(); - log_error(gettext("[Snort] Automatic clean-up of Snort logs completed.")); } +// Check the overall log directory limit (if enabled) and prune if necessary +if ($config['installedpackages']['snortglobal']['snortloglimit'] == 'on') + snort_check_dir_size_limit($config['installedpackages']['snortglobal']['snortloglimitsize']); + +return; + ?> |