Re: snort.stats key-value mapping

[Karolis <karolis.cepulis () gmail com>]

Hi Juan,

Thanks for reply. I have got same associative array but can I rely on it?
As I mentioned there are 96 keys and 131 values in the snort.stats file.
How do you know that first 96 keys correspond to the first 96 values
on one to one relationship and only the last values misses keys?
Can it be what there are gaps in key value pairs eg. key 10 correspond to
value 12?

Karolis



On Mon, Apr 6, 2015 at 11:14 AM, Juan Jesus Prieto <jjprieto () redborder org>
wrote:

>  Hi Karolis,
>
>   The manual is out-of-date at this point. I use scripting for dinamically
> map this pairs. For example:
>
> # declare -A v; \
> keys=( $(head /var/log/snort/snort.stats -n2 | tail -n1 | sed 's/^#//' | tr ',' ' ') ); \
> count=0; \
> for n in $(tail /var/log/snort/snort.stats -n1 | tr ',' ' '); do \
>    v[${keys[$count]}]=$n; \
>    count=$(($count+1)); \
>    done; \
> echo "stream5_mem_in_use: ${v['stream5_mem_in_use']}"; \
> echo "curr_tcp_sessions_established: ${v['curr_tcp_sessions_established']}"
> stream5_mem_in_use: 13950060
> curr_tcp_sessions_established: 5195
>
>
>
> This small script will map into a hash (named 'v') all pairs key/value and
> present last values from stats file (stream5_mem_in_use and
> curr_tcp_sessions_established in this example).
>
> Another option is to use my snmp passthrou agent:
>
> https://github.com/redBorder/rb_snmp_pass
>
> You will need to adapt it for your case.
>
>
> El mar, 31-03-2015 a las 10:03 +0300, Karolis escribió:
>
> Hi,
>
>
>  I am trying to map perfmonitor preprocessors statistics keys to values.
>
>
>
>  config:
>
>  preprocessor perfmonitor: time 300 file
> /nsm/sensor_data/"sensor-name"/snort.stats pktcnt 10000
>
>
>
>  snort manual   <http://manual.snort.org/node88.html>states "There are
> over 100 individual statistics included. A header line is output at startup
> and rollover that labels each column." although only 75 keys are listed.
>
>
>
>  snort.stats file has 96 keys  and 131 values.
>
>
>
>  How can I correctly map keys to values?
>
>
>
>  Karolis
>
>
>
>
>
>
>
>  ------------------------------------------------------------------------------
> Dive into the World of Parallel Programming The Go Parallel Website, sponsored
> by Intel and developed in partnership with Slashdot Media, is your hub for all
> things parallel software development, from weekly thought leadership blogs to
> news, videos, case studies, tutorials and more. Take a look and join the
> conversation now. http://goparallel.sourceforge.net/
> _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to 
> this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users 
> list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org 
> to stay current on all the latest Snort news!
>
>
>
>
> ------------------------------------------------------------------------------
> BPM Camp - Free Virtual Workshop May 6th at 10am PDT/1PM EDT
> Develop your own process in accordance with the BPMN 2 standard
> Learn Process modeling best practices with Bonita BPM through live
> exercises
> http://www.bonitasoft.com/be-part-of-it/events/bpm-camp-virtual-
> event?utm_
> source=Sourceforge_BPM_Camp_5_6_15&utm_medium=email&utm_campaign=VA_SF
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
------------------------------------------------------------------------------
BPM Camp - Free Virtual Workshop May 6th at 10am PDT/1PM EDT
Develop your own process in accordance with the BPMN 2 standard
Learn Process modeling best practices with Bonita BPM through live exercises
http://www.bonitasoft.com/be-part-of-it/events/bpm-camp-virtual- event?utm_
source=Sourceforge_BPM_Camp_5_6_15&utm_medium=email&utm_campaign=VA_SF

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!