Snort mailing list archives
Re: Unable to get snort to output unified logs
From: waldo kitty <wkitty42 () windstream net>
Date: Fri, 22 Aug 2014 18:05:27 -0400
On 8/22/2014 1:17 PM, Khanh Tran wrote:
Hello, I'm not sure what I'm doing wrong but snort consistently output pcap logs instead of unified2 format which is required by Barnyard2. Snort seems to ignore my unified output completely. Other outputs such as tcpdump, syslog and alerting worked fine. But my unified output line --> 'output unified2: filename snort.u2, limit 128' is completely ignored by snort. Even when this line is commented out, snort continues to generate snort.log.xxxx in pcap format. It seems to ignore output unified2 line completely.
what OS are you running snort on? i ask because we've seen instances where folks on *nix thought they were running the snort binary but were, instead, running a wrapper script which had hardcoded options in it which overrode what they thought they were sending on the command line... the way around this is to always use the path to execute snort so that you /know/ that what you think you are running is actually what you are running... eg: /usr/local/snort/bin/snort some command params here /etc/init.d/snort start -- NOTE: No off-list assistance is given without prior approval. Please *keep mailing list traffic on the list* unless private contact is specifically requested and granted. ------------------------------------------------------------------------------ Slashdot TV. Video for Nerds. Stuff that matters. http://tv.slashdot.org/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Unable to get snort to output unified logs Khanh Tran (Aug 22)
- Re: Unable to get snort to output unified logs waldo kitty (Aug 22)
- Re: Unable to get snort to output unified logs Khanh Tran (Aug 22)
- Re: Unable to get snort to output unified logs Jeremy Hoel (Aug 22)
- Re: Unable to get snort to output unified logs Khanh Tran (Aug 23)
- Re: Unable to get snort to output unified logs Khanh Tran (Aug 22)
- Re: Unable to get snort to output unified logs waldo kitty (Aug 22)