title: Why is a Snort log file displayed wrong when read in from Perl?
body: <p>I am writing a Perl program to read a <a href="http://www.snort.org/" rel="nofollow">Snort</a> log file. I run Fedora 14 using VMware.</p>
  
  <p>When using the command <code>/usr/loca/bin/snort -r /var/log/snort/snort.log.1299686068</code> I get the result:</p>
  
  <pre><code>03/08-21:16:03.609258 172.16.115.87:4159 -&gt; 205.181.112.67:80
  TCP TTL:63 TOS:0x0 ID:3588 IpLen:20 DgmLen:385 DF
  ***AP*** Seq: 0xEB6DE4B0  Ack: 0xD00D0DA6  Win: 0x7D78  TcpLen: 20
  =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
  
  03/08-21:16:03.627973 205.181.112.67:80 -&gt; 172.16.115.87:4159
  TCP TTL:64 TOS:0x0 ID:2458 IpLen:20 DgmLen:40 DF
  ***A**** Seq: 0xD00D0DA6  Ack: 0xEB6DE609  Win: 0x7E87  TcpLen: 20
  =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
  
  03/08-21:16:03.651503 205.181.112.67:80 -&gt; 172.16.115.87:4159
  TCP TTL:64 TOS:0x0 ID:2459 IpLen:20 DgmLen:978 DF
  ***AP*** Seq: 0xD00D0DA6  Ack: 0xEB6DE609  Win: 0x7FE0  TcpLen: 20
  =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+^C
  
  *** Caught Int-Signal
  03/08-21:16:03.654590 205.181.112.67:80 -&gt; 172.16.115.87:4159
  TCP TTL:64 TOS:0x0 ID:2460 IpLen:20 DgmLen:40
  ***A***F Seq: 0xD00D1150  Ack: 0xEB6DE609  Win: 0x7FE0  TcpLen: 20
  =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
  </code></pre>
  
  <p>The destination and source IP address and more information is listed, but when I use Perl to write a program to read them, what list out is unknown symbol.</p>
  
  <p>Isn't the log file protected by Snort or what else could be the problem? It is not exactly 100% displaying the result same as in the 1st example but at least clearly list out everything.</p>
  
  <p>My code is:</p>
  
  <pre><code>#!/usr/local/bin/perl
  use File::Tail;
  opendir L_FOL, "/var/log/snort" || die "Could not open LOGFOLDER direcotry\n $!";
  my @allrule = grep {/^snort.log./} readdir L_FOL;
  close L_FOL;
  foreach my $rulefile (@allrule) {
      open(LF, "/var/log/snort/$rulefile") or die "$!";
      while (&lt;LF&gt;) {
          print "$_\n";
      }
      close(LF);
  }
  </code></pre>