Snort mailing list archives
Barnyard2 Failing on Write to SQL Database
From: Jim Campbell <jim () w4bqp net>
Date: Wed, 7 Feb 2018 14:41:05 -0500
I am having recurring failures of Barnyard2 to write to the SQL database. I am running Snort 2.9.9.0 on a Ubuntu 17.04 computer in inline mode. I modify the rules file /etc/snort/rules/snortd.rules to block packets rather than alert on them.
Each time the failure occurrs, the /var/log/snort/snort.u2... file contains the same records at the beginning. I will add the beginning of the u2 file below. Further down in the u2 file (below) it mentions a Silverlight update but the GID and SID don't match the ones in the u2 file.-
Snort continues to run and write to the u2 file but since Barnyard2 is in a failed state I get nothing from Base.
========================================================My command line for Snort is: /usr/local/bin/snort -Q -q -u snort -g snort -c /etc/snort/snort.conf -i enp1s0:enp4s0
My command line for Barnyard2 is: /usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.u2 -q -w /var/log/snort/barnyard2.waldo -a /var/log/snort/archived_logs/ -u root -g snort
When I query the status of Barnyard2 after a failure I get: ● barnyard2.service - Barnyard2 DaemonLoaded: loaded (/lib/systemd/system/barnyard2.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since Mon 2018-02-05 14:48:30 EST; 57min ago
Main PID: 27146 (code=exited, status=1/FAILURE) Feb 05 14:21:06 jim-IPS systemd[1]: Started Barnyard2 Daemon.Feb 05 14:48:30 jim-IPS barnyard2[27146]: ERROR: database mysql_error: Duplicate entry '69943-1' for key 'PRIMARY' Feb 05 14:48:30 jim-IPS barnyard2[27146]: SQL=[INSERT INTO sig_reference (ref_id,sig_id,ref_seq) VALUES ('152087','69943','1');]
Feb 05 14:48:30 jim-IPS barnyard2[27146]: Fatal Error, Quitting..Feb 05 14:48:30 jim-IPS systemd[1]: barnyard2.service: Main process exited, code=exited, status=1/FAILURE Feb 05 14:48:30 jim-IPS systemd[1]: barnyard2.service: Unit entered failed state. Feb 05 14:48:30 jim-IPS systemd[1]: barnyard2.service: Failed with result 'exit-code'.
I have scanned the rules file (/etc/snort/rules/snortd.rules) and don't find any occurrences of "152087" or "69943".
Beginning of the output of u2spewfoo on the log file: (Event)sensor id: 0 event id: 1 event second: 1517940080 event microsecond: 56660
sig id: 16 gen id: 129 revision: 1 classification: 3priority: 2 ip source: 34.215.60.2 ip destination: 192.168.254.2 src port: 80 dest port: 33804 protocol: 6 impact_flag: 32 blocked: 1
Packet sensor id: 0 event id: 1 event second: 1517940080 packet second: 1517940080 packet microsecond: 56660 linktype: 1 packet_length: 60 [ 0] B0 7F B9 1A 2E FF 00 26 91 56 78 0B 08 00 45 00 .......&.Vx...E. [ 16] 00 28 A2 9D 40 00 EA 06 D0 AD 22 D7 3C 02 C0 A8 .(..@.....".<... [ 32] FE 02 00 50 84 0C 46 4E FA 61 00 74 2D 65 50 11 ...P..FN.a.t-eP. [ 48] 75 40 2A 29 00 00 00 00 00 00 00 00 u@*)........ (Event)sensor id: 0 event id: 2 event second: 1517963742 event microsecond: 913508
sig id: 4 gen id: 120 revision: 1 classification: 2priority: 3 ip source: 72.21.81.240 ip destination: 192.168.254.2 src port: 80 dest port: 53900 protocol: 6 impact_flag: 32 blocked: 1
Packet sensor id: 0 event id: 2 event second: 1517963742 packet second: 1517963742 packet microsecond: 913508 linktype: 1 packet_length: 1514 [ 0] B0 7F B9 1A 2E FF 00 26 91 56 78 0B 08 00 45 00 .......&.Vx...E. [ 16] 05 DC E7 49 40 00 36 06 FF 21 48 15 51 F0 C0 A8 ...I@.6..!H.Q... [ 32] FE 02 00 50 D2 8C 7E 5D AB 65 4F 71 60 93 50 10 ...P..~].eOq`.P. [ 48] 01 22 13 19 00 00 48 54 54 50 2F 31 2E 31 20 32 ."....HTTP/1.1 2 [ 64] 30 30 20 4F 4B 0D 0A 41 63 63 65 70 74 2D 52 61 00 OK..Accept-Ra [ 80] 6E 67 65 73 3A 20 62 79 74 65 73 0D 0A 43 61 63 nges: bytes..Cac [ 96] 68 65 2D 43 6F 6E 74 72 6F 6C 3A 20 70 75 62 6C he-Control: publ [ 112] 69 63 2C 6D 61 78 2D 61 67 65 3D 31 37 32 38 30 ic,max-age=17280 [ 128] 30 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 0..Content-Type: [ 144] 20 74 65 78 74 2F 70 6C 61 69 6E 0D 0A 44 61 74 text/plain..Dat [ 160] 65 3A 20 57 65 64 2C 20 30 37 20 46 65 62 20 32 e: Wed, 07 Feb 2 [ 176] 30 31 38 20 30 30 3A 33 35 3A 34 32 20 47 4D 54 018 00:35:42 GMT [ 192] 0D 0A 45 74 61 67 3A 20 22 38 30 34 33 35 31 35 ..Etag: "8043515 [ 208] 32 38 38 62 30 63 63 31 3A 30 22 0D 0A 4C 61 73 288b0cc1:0"..Las [ 224] 74 2D 4D 6F 64 69 66 69 65 64 3A 20 46 72 69 2C t-Modified: Fri, [ 240] 20 30 32 20 44 65 63 20 32 30 31 31 20 30 30 3A 02 Dec 2011 00: [ 256] 32 31 3A 32 33 20 47 4D 54 0D 0A 53 65 72 76 65 21:23 GMT..Serve Thanks for any help, Jim _______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
Current thread:
- Barnyard2 Failing on Write to SQL Database Jim Campbell (Feb 07)
- Re: Barnyard2 Failing on Write to SQL Database Marcin Dulak via Snort-users (Feb 07)
- Re: Barnyard2 Failing on Write to SQL Database Jim Campbell (Feb 07)
- Re: Barnyard2 Failing on Write to SQL Database Marcin Dulak via Snort-users (Feb 07)