Re: Barnyard outputting to both acid and sguil via MySQL on remote DB server

Shon Burton wrote:
> I'm having a problem getting Barnyard to push data into my acid db.
> It's working well for sguil in a seperate DB, but I'm not getting any
> data in the acid DB. I'm also not getting any erros from Barnyard, or
> any indication that it actually started the acid output plugin.
>
> Is anyone running both? Is there something else I need for acid output?
>
> My Barnyard config line for acid is:
>
> output alert_acid_db: mysql, sensor_id 1, database acid, server
> ids-db, user acidviewer, password mypassword

Try removing the "sensor_id" option from the output plug-in 
configuration.  This will have Barnyard auto-assign an id and add it to 
the ACID sensors table.  Then your events should show up.  The 
"sensor_id" option is intended for people converting from an ACID/Snort 
installation that want to re-use the same sensor ID.

-A


-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl