Snort mailing list archives
barnyard
From: "Brian Krusic" <brian () krusic com>
Date: Fri, 27 Jan 2006 16:47:14 -0800
Hi, I've a question regarding barnyard (I happen to call one of my best friends by this name :) I'm not sure what to do with the results. My command line; barnard -c /usr/local/barnyard/etc/barnyard.conf -d /var/log/snort -g /usr/local/snort/etc/gen-msg.map -s /usr/local/snort/etc/sid-msg.map -f snort.alert I pretty much got this from the barnyard USAGE file but don't understand the -f option as I expect to see a snort.alert file. I do see info in both the gen-msg.map and sid-msg.map files but am not sure wether I am supposed to filter or tail or cat these files. The reason I'd like to use barnyard is that; 1) I've a gig e network and the manual says that you may want to use some kind of binary reader in this case for speed. 2) I'd rather not use the console output as it can be slow. 3) with barnyard I have the option of picking up where I left off in the event of a crashed program or system and don't have to look at the entire output from the begining. Thanks in advance, Bri-
Current thread:
- barnyard Brian Krusic (Jan 27)
- Re: barnyard Jason (Jan 27)
- Re: barnyard Paul Schmehl (Jan 27)