0

I am a novice Python/Linux enthusiast running Suricata on a Linux VM and am trying to execute a Python script to email myself the fast.log logs every morning.

What I first want to happen is a list of the latest 15 alerts to be created via tails command:

0 5 * * * root tail -n 200 /var/log/suricata/fast.log > daylogs.txt

Then this Python script sends the daylogs.txt as an email is executed:

import smtplib

smtpObj = smtplib.SMTP('smtp.gmail.com', 587)
smtpObj.ehlo()

smtpObj.starttls()

smtpObj.login('x', 'xx')

with open('/var/log/suricata/fast.log', 'r') as file:
        lines=file.readlines()

g = open('/var/log/suricata/daylogs.txt', 'w+')

#print(g)

for i in range(1, 15):
        g.write(lines[i*-1])

print(g)

g.close()

with open ('/var/log/suricata/daylogs.txt', 'r') as file:
        m = file.read()

#message = str(m)

#str.split(message)

print(m)

smtpObj.sendmail('x@gmail.com', 'x@gmail.com', 'Subject: IDS ALERTS\n\n'+m)

smtpObj.quit()

Then this script will execute via a cron:

30 5 * * * root /var/log/suricata/latest.py

Permissions:

-rw-r--r-- 1 root root     342706 Aug 30 19:22 fast.log
-rw-r--r-- 1 root root        612 Aug  9 17:52 latest.py

However, nothing happens. I am able to run the python script from CLI and receive the emailed alert, however. Not sure what I am doing wrong, but I'm still a noob at this so any suggestions are welcome!

From syslog:

Aug 30 05:30:01 rupert-VirtualBox CRON[1188615]: (CRON) info (No MTA installed, discarding output)
Aug 30 05:30:01 rupert-VirtualBox CRON[1188617]: (rupert) CMD (root    /var/log/suricata/latest.py)
Aug 30 05:30:01 rupert-VirtualBox CRON[1188616]: (CRON) info (No MTA installed, discarding output)
Aug 30 05:30:01 rupert-VirtualBox CRON[1188619]: (root) CMD (   /var/log/suricata/latest.py)
Aug 30 05:30:01 rupert-VirtualBox CRON[1188614]: (CRON) info (No MTA installed, discarding output)```



The syslogs this morning:  
                                                                                                                  
 ```Aug 31 05:00:01 rupert-VirtualBox CRON[1235735]: (root) CMD (tail -n 200 /var/log/suricata/fast.log > daylogs.txt )
Aug 31 05:00:01 rupert-VirtualBox CRON[1235736]: (rupert) CMD (root    tail -n 200 /var/log/suricata/fast.log > daylogs.txt)
Aug 31 05:00:01 rupert-VirtualBox CRON[1235734]: (CRON) info (No MTA installed, discarding output)
Aug 31 05:00:01 rupert-VirtualBox CRON[1235737]: (root) CMD (   tail -n 200 /var/log/suricata/fast.log > daylogs.txt)       

Aug 31 05:17:01 rupert-VirtualBox CRON[1235751]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Aug 31 05:30:01 rupert-VirtualBox CRON[1235762]: (root) CMD (/var/log/suricata/latest.py)
Aug 31 05:30:01 rupert-VirtualBox CRON[1235760]: (CRON) info (No MTA installed, discarding output)
Aug 31 05:30:01 rupert-VirtualBox CRON[1235763]: (rupert) CMD (root    /var/log/suricata/latest.py 2>&1)
Aug 31 05:30:01 rupert-VirtualBox CRON[1235761]: (CRON) info (No MTA installed, discarding output)
Aug 31 05:30:01 rupert-VirtualBox CRON[1235764]: (root) CMD (   /var/log/suricata/latest.py)
Aug 31 05:30:01 rupert-VirtualBox CRON[1235759]: (CRON) info (No MTA installed, discarding output) ```
robreiner
  • 1
  • 1

0 Answers0