如何将Snort日志转换为JSON文件？IDS项目技术求助

一、Snort 2.9日志转JSON #

Snort 2.9默认日志为非结构化文本或Unified2格式，需先解析才能转JSON：

1. 用Snort自带工具解析Unified2日志 #

如果Snort输出Unified2格式（默认配置），直接用u2json转换：

u2json -r /var/log/snort/unified2.log -o snort_alerts.json

若缺少u2json，可通过编译Snort时启用对应模块，或用barnyard2配合JSON输出插件：

barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f unified2.log -w snort_alerts.json -o json

2. 自定义解析纯文本告警日志 #

如果Snort输出纯文本alert日志，用Python脚本解析：

import json
import re

def parse_snort_alert(log_path):
    alerts = []
    # 匹配Snort文本告警的正则规则
    alert_pattern = re.compile(r'\[(\d+:\d+:\d+)\] (.+?) \[Classification: (.+?)\] \[Priority: (\d+)\] \{(.+?)\} (\d+\.\d+\.\d+\.\d+):(\d+) -> (\d+\.\d+\.\d+\.\d+):(\d+)')
    
    with open(log_path, 'r') as f:
        for line in f:
            match = alert_pattern.match(line.strip())
            if match:
                alerts.append({
                    'sid_rev_gid': match.group(1),
                    'message': match.group(2),
                    'classification': match.group(3),
                    'priority': int(match.group(4)),
                    'protocol': match.group(5),
                    'src_ip': match.group(6),
                    'src_port': int(match.group(7)),
                    'dst_ip': match.group(8),
                    'dst_port': int(match.group(9))
                })
    
    with open('snort_alerts.json', 'w') as out_f:
        json.dump(alerts, out_f, indent=2)

parse_snort_alert('/var/log/snort/alert')

二、Flask中加载JSON并处理 #

1. 读取JSON文件返回给前端 #

在Flask路由中直接读取生成的JSON，解决无法运行问题：

from flask import Flask, jsonify
import json

app = Flask(__name__)

@app.route('/api/alerts')
def get_alerts():
    try:
        # 建议用绝对路径避免路径问题
        with open('/path/to/snort_alerts.json', 'r') as f:
            alerts = json.load(f)
        return jsonify(alerts)
    except Exception as e:
        return jsonify({'error': str(e)}), 500

if __name__ == '__main__':
    app.run(debug=True, host='0.0.0.0')

排查要点：

• 验证JSON格式合法性（用jsonlint工具检查）
• 确保Flask依赖已安装：pip install flask
• 检查日志文件读取权限

2. 实时解析日志（跳过中间JSON文件） #

若要实时获取告警，直接在Flask中调用解析函数：

@app.route('/api/alerts/realtime')
def get_realtime_alerts():
    alerts = parse_snort_alert('/var/log/snort/alert')
    return jsonify(alerts)

三、将Snort告警存储到MySQL #

1. 创建数据库表 #

CREATE TABLE snort_alerts (
    id INT AUTO_INCREMENT PRIMARY KEY,
    sid_rev_gid VARCHAR(20) NOT NULL,
    message TEXT NOT NULL,
    classification VARCHAR(100) NOT NULL,
    priority INT NOT NULL,
    protocol VARCHAR(20) NOT NULL,
    src_ip VARCHAR(45) NOT NULL,
    src_port INT NOT NULL,
    dst_ip VARCHAR(45) NOT NULL,
    dst_port INT NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

2. Flask集成MySQL存储 #

用mysql-connector-python实现数据插入：

import mysql.connector
from mysql.connector import Error

def save_alerts_to_mysql(alerts):
    try:
        connection = mysql.connector.connect(
            host='localhost',
            database='snort_db',
            user='your_db_user',
            password='your_db_pass'
        )
        if connection.is_connected():
            cursor = connection.cursor()
            insert_query = """
                INSERT INTO snort_alerts (sid_rev_gid, message, classification, priority, protocol, src_ip, src_port, dst_ip, dst_port)
                VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s)
            """
            # 批量插入优化性能
            cursor.executemany(insert_query, [
                (
                    alert['sid_rev_gid'],
                    alert['message'],
                    alert['classification'],
                    alert['priority'],
                    alert['protocol'],
                    alert['src_ip'],
                    alert['src_port'],
                    alert['dst_ip'],
                    alert['dst_port']
                ) for alert in alerts
            ])
            connection.commit()
    except Error as e:
        print(f"MySQL错误: {e}")
    finally:
        if connection.is_connected():
            cursor.close()
            connection.close()

# 在Flask路由中调用存储逻辑
@app.route('/api/alerts/save')
def save_alerts():
    alerts = parse_snort_alert('/var/log/snort/alert')
    save_alerts_to_mysql(alerts)
    return jsonify({'status': 'success', 'count': len(alerts)})

注意：

• 安装依赖：pip install mysql-connector-python
• 添加去重逻辑（比如根据sid_rev_gid+src_ip+dst_ip判断重复）
• 确保MySQL服务正常运行，数据库用户有写入权限

常见问题排查 #

• 日志转JSON失败：检查Snort日志格式是否匹配解析规则，Unified2日志需确保是Snort正在写入的最新文件
• Flask运行报错：查看终端错误信息，排查端口占用、JSON格式错误、文件权限问题
• MySQL存储失败：核对连接参数、表字段类型是否匹配（比如端口是INT类型，不能存字符串）

内容的提问来源于stack exchange，提问作者Doctor Wise