I run snort 3 via command

sudo snort -c snort.conf -i ens33 -A alert_unixsock -l /tmp

where as snort gives error: "/tmp/snort_alert file doesn't exist or isn't writable".

Can any one share code for receiver end and snort end.

1

There are 1 best solutions below

0
mickeyM0use On

You need to create a socket file where the alerts can be sent to. The default name of this file is 'snort_alert' and it has to be located in your specified log directory '-l' which in this case is '/tmp'.
Once you have this file then you can send alerts to it and listen using a socket connection.
Read and write from Unix socket connection with Python
This link might help you with the socket that you need to create.