Re: Need help in getting barnyard and Snort to work together

[Paul Schmehl <pauls () utdallas edu>]

--On Wednesday, January 30, 2008 18:37:17 -0500 sudhakar govindavajhala 
<sudhakarg79spam () gmail com> wrote:

> Hi folks,
>
> Thanks for the great support in getting Barnyard to work.    I am almost
> there! :-)
>
> I have been using this resource:
> http://searchenterpriselinux.techtarget.com/tip/0,289483,sid39_gci1255683,00.
> html
>
>
> 1) I managed to install Snort+BASE+PHP+MYSQL.
> 2) Verified that Snort is working by using Metasploit.
> 3) Changed snort.conf to make Snort output in unified logging mode.
> With metasploit running, the size of alert and snort.log file increases. So,
> I am guessing unified output mode is also working.
>
> 4) verified that banyard is able to take info from snort.log file. command
> line works:
>
> barnyard -c /etc/barnyard.conf  -s /etc/snort/sid-msg.map -g
> /etc/snort/gen-msg.map -p /etc/snort/classification.config -o
> snort.log.1201695424
>
> BASE picks up this alert/log
>
>
>
>
> Now, I need to get barnyard in continual mode working.
>
> Questions:
> 1) Should Snort be started first or barnyard?

Barnyard should always be started first *if* you have added new rules. 
Barnyard needs to read the sid-msg.map file in order to "know" what the 
user-friendly names of the rules are.  Otherwise it doesn't matter which is 
started first.

> 2) As I noticed, each time Snort is restarted, the log file name changes.
> For example, snort.log.1201695424 to snort.log.12016923232.  Why?  Change in
> log file name implies that barnyard.waldo needs to change every time there is
> a reboot, making configurations unstable.

That's normal behavior and has no ill effects.

> 3) What can be done to get Snort to stop changing the names of the log files?

Change the source code.

> Can you tell me what I need to do from here to be able to automate Snort and
> barnyard?

Without knowing what OS you're using?  Not likely.

BTW, if you read the source code for base, you'll discover that you can add 
this to the barnyard.conf file and eliminate some of the long commandline when 
you start barnyard.

config class-file: /usr/local/etc/snort/classification.config
config sid-msg-map: /usr/local/etc/snort/sid-msg.map
config gen-msg-map: /usr/local/etc/snort/gen-msg.map

(Change the paths to fit your OS.)

So, having done that, you could start barnyard like this:
barnyard -D -c /etc/barnyard.conf -d /path-to/snort.log-directory -f snort.log 
-w path-to/waldo.file

Barnyard will figure out which log file to open and keep track of where it's at 
in the waldo file.

-- 
Paul Schmehl (pauls () utdallas edu)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users