Skip to content
This repository has been archived by the owner on Apr 19, 2021. It is now read-only.

Commit

Permalink
sostat: output when no packet drops for Suricata
Browse files Browse the repository at this point in the history
  • Loading branch information
weslambert committed Jul 14, 2016
1 parent 46deced commit b63e3d9
Showing 1 changed file with 9 additions and 3 deletions.
12 changes: 9 additions & 3 deletions bin/sostat
Original file line number Diff line number Diff line change
Expand Up @@ -112,8 +112,15 @@ if [ -d /nsm/sensor_data ]; then
if [ "$ENGINE" = "suricata" ]; then
for i in /nsm/sensor_data/*/stats.log; do
echo "$i"
tail -n 50 "$i" | grep -e "Date: " -e "drop"
echo
if [ $( tail -n 50 $i | grep -c drop $i) -ne 0 ]; then

This comment has been minimized.

Copy link
@dougburks

dougburks Jul 20, 2016

Contributor

It looks like we take the last 50 lines of the stats.log ($i) and pipe that into a grep of the same file. Is that correct?

This comment has been minimized.

Copy link
@weslambert

weslambert via email Jul 20, 2016

Author Contributor

This comment has been minimized.

Copy link
@dougburks

dougburks Jul 20, 2016

Contributor

Should the grep be searching the tail output instead of searching the file directly? Meaning that we should take tail -n 50 $i | grep -c drop $i and remove the second $i, making it just tail -n 50 $i | grep -c drop?

This comment has been minimized.

Copy link
@weslambert

weslambert via email Jul 20, 2016

Author Contributor

This comment has been minimized.

Copy link
@dougburks

dougburks Jul 20, 2016

Contributor

Sounds good, thanks Wes!

echo
tail -n 50 "$i" | grep -e "Date: " -e "drop"
echo
else
echo
echo "No packet drops reported."
echo
fi
done
else
for i in /nsm/sensor_data/*/snort-*.stats; do
Expand All @@ -125,7 +132,6 @@ if [ -d /nsm/sensor_data ]; then
fi
done
fi
echo
echo "-------------------------------------------------------------------------"
echo
TMP=`mktemp`
Expand Down

0 comments on commit b63e3d9

Please sign in to comment.