Rolling over a Parser File

ahuang14 has asked for the wisdom of the Perl Monks concerning the following question:

Hey guys,

I was just wondering if there were any ideas about how to roll over a file that is parsing a continuous Snort log file. I am currently keeping Snort on 24/7 to log all network problems and then having a Perl program with Tail, parse out the information I need with each entry. However, I want to be able to have one file created each day, rather than having to manually do it myself. Right now I am basically Tailing the Snort file, parsing it, and appending it to a file x.log that I specify (just a simple text file). Is there a way to tell Perl to log for x hours or until x MB and then create a new file to append and write subsequent parsings to?

Thanks in advance

Comment on Rolling over a Parser File

Replies are listed 'Best First'.
Re: Rolling over a Parser File by FunkyMonk (Chancellor) on Aug 08, 2011 at 15:22 UTC
Make sure the filename is based on the current date and always open for each write. Something like `sub loggit { my @gmt = gmtime; my $date = sprintf "%04d%02d%02d", $gmt[5]+1900, $gmt[4]+1, $gmt[3 +]; my $file = "$date.log"; open my $log, ">>", $file or die $!; print $log, @_; close $log; }` [download]	[reply] [d/l]
Re^2: Rolling over a Parser File by ahuang14 (Novice) on Aug 08, 2011 at 18:18 UTC
Right but how do I get my computer to create a new file every day? this is saying that on $date log everything to that file, which is what I want, but how does my computer know to create a new file everyday that this code can be run on?	[reply]
Re^3: Rolling over a Parser File by ahuang14 (Novice) on Aug 08, 2011 at 18:49 UTC
never mind I got it to work. Thanks alot!	[reply]
Re: Rolling over a Parser File by Perlbotics (Archbishop) on Aug 08, 2011 at 15:28 UTC
... and there is also the standard recommendation for the fine Log::Log4perl modules. See also Log::Dispatch::FileRotate. A nice introduction can be found here: Retire your debugger, log smartly with Log::Log4perl! If you just need a lightweight implementation, stay with FunkyMonks solution above, though.	[reply]
Re: Rolling over a Parser File by Arunbear (Prior) on Aug 09, 2011 at 10:16 UTC
This is what logrotate is for (unless your system doesn't have it?).	[reply]


go ahead... be a heretic
	PerlMonks