Snort mailing list archives
Need help in getting barnyard and Snort to work together
From: "sudhakar govindavajhala" <sudhakarg79spam () gmail com>
Date: Wed, 30 Jan 2008 18:37:17 -0500
Hi folks, Thanks for the great support in getting Barnyard to work. I am almost there! :-) I have been using this resource: http://searchenterpriselinux.techtarget.com/tip/0,289483,sid39_gci1255683,00.html 1) I managed to install Snort+BASE+PHP+MYSQL. 2) Verified that Snort is working by using Metasploit. 3) Changed snort.conf to make Snort output in unified logging mode. With metasploit running, the size of alert and snort.log file increases. So, I am guessing unified output mode is also working. 4) verified that banyard is able to take info from snort.log file. command line works: barnyard -c /etc/barnyard.conf -s /etc/snort/sid-msg.map -g /etc/snort/gen- msg.map -p /etc/snort/classification.config -o snort.log.1201695424 BASE picks up this alert/log Now, I need to get barnyard in continual mode working. Questions: 1) Should Snort be started first or barnyard? 2) As I noticed, each time Snort is restarted, the log file name changes. For example, snort.log.1201695424 to snort.log.12016923232. Why? Change in log file name implies that barnyard.waldo needs to change every time there is a reboot, making configurations unstable. 3) What can be done to get Snort to stop changing the names of the log files? Can you tell me what I need to do from here to be able to automate Snort and barnyard? Thanks, --Sudhakar and it outputs in unified logging mode. 2) I checked that Snort
------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Need help in getting barnyard and Snort to work together sudhakar govindavajhala (Jan 30)
- Re: Need help in getting barnyard and Snort to work together Paul Schmehl (Jan 30)
- Re: Need help in getting barnyard and Snort to work together sudhakar govindavajhala (Jan 30)
- Re: Need help in getting barnyard and Snort to work together Paul Schmehl (Jan 31)
- Re: Need help in getting barnyard and Snort to work together sudhakar govindavajhala (Jan 30)
- Re: Need help in getting barnyard and Snort to work together Paul Schmehl (Jan 30)