Snort mailing list archives
Re: Problem with barnyard 0.2.0 and snort 2.4.0
From: Paul Schmehl <pauls () utdallas edu>
Date: Sat, 20 Aug 2005 11:55:45 -0500
--On August 20, 2005 12:44:35 AM -0500 eric-list-snort-users () catastrophe net wrote:
My barnyard.conf is as follows... config localtime config hostname: gw1 config interface: bridge0 config filter: not port 22 output log_acid_db: mysql, database snort, server 10.19.81.137, user foo, password bar, detail full [wrapped for clarity] Next I start barnyard in the following manner... # /var/snort/bin/barnyard -c /var/snort/etc/barnyard.conf \ -s /var/snort/etc/sid-msg.map -g /var/snort/etc/gen-msg.map \ -p /var/snort/etc/classification.config -d /var/snort/log \ -f snort.log -w /var/snort/log/snort_ids.log
You can add the following to the config section of your barnyard conf file: config sid-msg-map: /usr/local/share/snort/sid-msg.map config gen-msg-map: /usr/local/share/snort/gen-msg.map config class-file: /usr/local/share/snort/classification.config (adjust the paths to the files to match your locations) which will allow you to reduce your barnyard startup to the following:
# /var/snort/bin/barnyard -c /var/snort/etc/barnyard.conf \ -d /var/snort/log -f snort.log -w /var/snort/log/snort_ids.log
WARNING: Bookmark file is corrupt, only processing new events
Delete your waldo file (/var/log/snort/log/snort_ids.log) and allow barnyard to recreate it. It's apparently corrupted.
I also strongly recommend that you do not use localtime with barnyard. It causes problems during the change from daylight savings to "normal" time.
Paul Schmehl (pauls () utdallas edu) Adjunct Information Security Officer University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu/ ------------------------------------------------------- SF.Net email is Sponsored by the Better Software Conference & EXPO September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Problem with barnyard 0.2.0 and snort 2.4.0 eric-list-snort-users (Aug 19)
- Re: Problem with barnyard 0.2.0 and snort 2.4.0 Paul Schmehl (Aug 20)
- Re: Problem with barnyard 0.2.0 and snort 2.4.0 eric-list-snort-users (Aug 20)
- Re: Problem with barnyard 0.2.0 and snort 2.4.0 Paul Schmehl (Aug 20)
- Re: Problem with barnyard 0.2.0 and snort 2.4.0 eric-list-snort-users (Aug 20)
- Re: Problem with barnyard 0.2.0 and snort 2.4.0 eric-list-snort-users (Aug 20)
- Re: Problem with barnyard 0.2.0 and snort 2.4.0 eric-list-snort-users (Aug 20)
- Re: Problem with barnyard 0.2.0 and snort 2.4.0 eric-list-snort-users (Aug 20)
- Re: Problem with barnyard 0.2.0 and snort 2.4.0 Paul Schmehl (Aug 20)
- Re: Problem with barnyard 0.2.0 and snort 2.4.0 Paul Schmehl (Sep 19)