--- ../../../cvs/sguil/server/xscriptd	2003-10-29 17:22:46.000000000 -0800
+++ xscriptd	2003-11-16 13:51:11.000000000 -0800
@@ -16,6 +16,13 @@
 set LOCAL_LOG_DIR /snort_data/archive
 # Where xscriptd can find the remote raw files
 set REMOTE_LOG_DIR /snort_data/dailylogs
+# What is the prefix for log files
+set LOG_FILE_PREFIX pcap
+# Which is the delimiter surrounding the timestamp in the filename
+set LOG_FILE_DELIMITER '.'
+# Which column the timestamp is located in the filename
+# The timestamp is assumed to be in the last column (at the end of the filename)
+set LOG_FILE_TIMESTAMP_COLUMN 2
 # Path to different execs here. If you need to send flags then put them here also
 # set SSH "/usr/bin/ssh -p 1234"
 # NOTE: You only need these if you are using remote sensors (ie LOCALSENSOR=0)
@@ -48,6 +55,7 @@
 
 proc GetRawDataFromLocal { timestamp srcIP srcPort dstIP dstPort proto sensorDir rawDataFileName {socketID {NONE} } } {
   global LOCAL_LOG_DIR REMOTE_LOG_DIR DEBUG TCPDUMP
+  global LOG_FILE_PREFIX LOG_FILE_TIMESTAMP_COLUMN LOG_FILE_DELIMITER
   set date [lindex $timestamp 0]
   if {$socketID != "NONE"} { puts $socketID "DEBUG"; puts $socketID "Sensor is LOCAL."}
   if { [file exists $REMOTE_LOG_DIR/$date] && [file isdirectory $REMOTE_LOG_DIR/$date] } { 
@@ -63,8 +71,10 @@
   cd $REMOTE_LOG_DIR/$date
   if {$DEBUG} {puts $REMOTE_LOG_DIR/$date}
   if {$socketID != "NONE"} { puts $socketID "Making a list of local log files in $REMOTE_LOG_DIR/$date."}
-  foreach logFile [glob -nocomplain snort.log.*] {
-    lappend logFileTimes [lindex [split $logFile .] 2]
+  foreach logFile [glob -nocomplain $LOG_FILE_PREFIX*] {
+    set logFileTime [lindex [split $data $LOG_FILE_DELIMITER] $LOG_FILE_TIMESTAMP_COLUMN]
+    lappend logFileTimes $logFileTime
+    set logFileNames($logFileTime) $data
   }
   if { ! [info exists logFileTimes] } {
     if {$DEBUG} {puts "No matching log files."}
@@ -81,7 +91,7 @@
   # The first file we find with a time >= to ours should have our packets.
   foreach logFileTime $sLogFileTimes {
     if { $eventTime >= $logFileTime } {
-      set logFileName "snort.log.$logFileTime"
+      set logFileName $logFileNames($logFileTime)
       break
     }
   }
@@ -100,6 +110,7 @@
 }
 proc GetRawDataFromSensor { sensor timestamp srcIP srcPort dstIP dstPort proto sensorDir rawDataFileName {socketID {NONE} } } {
   global LOCAL_LOG_DIR REMOTE_LOG_DIR SSH SCP TCPDUMP DEBUG
+  global LOG_FILE_PREFIX LOG_FILE_TIMESTAMP_COLUMN LOG_FILE_DELIMITER
   set date [lindex $timestamp 0]
   if {$DEBUG} {puts "Getting a list of raw data files from $sensor."}
   if {$socketID != "NONE"} { 
@@ -112,12 +123,14 @@
   # First we need to get a list of raw data files on the sensor so we can
   # determine what file to pull the data from. For now we are using ssh to
   # do this. Logfiles are in the format of snort.log.unixtime.
-  set sshID [open "| $SSH -v $sensor cd $REMOTE_LOG_DIR/$date; ls snort.log.*" r]
+  set sshID [open "| $SSH -v $sensor cd $REMOTE_LOG_DIR/$date; ls $LOG_FILE_PREFIX*" r]
   if {$socketID != "NONE"} { puts $socketID "Remote log files:" }
   while { [gets $sshID data] >= 0 } {
     if {$DEBUG} {puts $data}
     if {$socketID != "NONE"} { puts $socketID $data}
-    lappend logFileTimes [lindex [split $data .] 2]
+    set logFileTime [lindex [split $data $LOG_FILE_DELIMITER] $LOG_FILE_TIMESTAMP_COLUMN]
+    lappend logFileTimes $logFileTime
+    set logFileNames($logFileTime) $data
   }
   catch {close $sshID} closeError
   if { ! [info exists logFileTimes] } {
@@ -130,7 +143,7 @@
   # The first file we find with a time >= to ours should have our packets.
   foreach logFileTime $sLogFileTimes {
     if { $eventTime >= $logFileTime } {
-      set logFileName "snort.log.$logFileTime"
+      set logFileName $logFileNames($logFileTime)
       break
     }
   }