Skip to main content

IDS Utility Library

Project description is a collection of Python libraries for working with IDS systems (typically Snort and Suricata).


  • Snort/Suricata unified2 log file reading.
  • Continuous unified2 directory spool reading with bookmarking (a’la Barnyard2).
  • Parser and mapping for classification.config.
  • Parser and mapping for and


  • Python 2.6 or 2.7; Python 3.3 works but not as well tested.
  • Currently only tested on Linux.

Example Programs

Example programs are found in the examples/ directory and demonstrate basic usage of the idstools libraries. is a Python program similar to u2spewfoo provided by Snort. It reads and prints records from one or more unified2 log files.

usage: python ./examples/ <file1> [file2 …] reads unified2 log files and prints out events in the “fast” format.

usage: python ./examples/
-C /path/to/classification.config -S /path/to/ -G /path/to/

While not really IDS related, shows an example of how one might do a “tail -f” on a spool directory of line oriented text files.

usage: ./examples/ [options] <directory> <prefix>


--delete delete files on close (when a new one is opened)
--bookmark enable spool bookmarking

The delete option will delete a file when it has been completely read and there is a new spool file to open.

Bookmarking will remember the last location read so subsequent invocations will start where the last instance of finished.

Bookmarking and delete on close give you basic barnyard2 like behaviour where files are removed when they have been processed, and the current processing location is remembered.

A “tail -f” like program for reading unified2 spool directories as created by Snort and Suricata.

usage: ./examples/ [options] <directory> <prefix>


--delete delete files on close (when a new one is opened)
--bookmark enable spool bookmarking
--records read records instead of events

Reading records in events will read individual unified2 records and print them one at a time. The default behaviour is to aggregate records into complete events.

The delete and bookmark options are the same as they are for

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for idstools, version 0.1.1
Filename, size File type Python version Upload date Hashes
Filename, size idstools-0.1.1.tar.gz (10.9 kB) File type Source Python version None Upload date Hashes View

Supported by

Pingdom Pingdom Monitoring Google Google Object Storage and Download Analytics Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page