This script can be used not just for snort, but any kind of logs. It emails you just the changes that occured from last check in the logs.
For the script to run, you need logtail (which is part of the logcheck application). In Debian-based systems do:
$ apt-get install logtail
If it’s not in your distributions repositories, install logcheck from sources.
Now here’s the Citește în continuare