Re: Fwd: Re: issues with FreeBSD barnyard port ( amd64 )

--On Monday, March 14, 2005 01:30:31 PM -0800 Ben Calvert 
<ben@xxxxxxxxxxxxxxxx> wrote:
> except now i'm segfaulting :)  does this syntax look correct?
Barnyard sometimes segfaults if you don't have all the correct options 
specified.

In the barnyard.conf file, add these lines in the config section:

# set other config options
config sid-msg-map: /usr/local/share/snort/sid-msg.map
config gen-msg-map: /usr/local/share/snort/gen-msg.map
config class-file: /usr/local/share/snort/classification.config

These will save you having to use an incredibly long commandline to start 
by.

> output log_acid_db: postgres, database snort_db, server <dbserver>, user
> snort, password <pass>
> output alert_acid_db: postgres, database snort_db, server <dbserver>,
> user  snort, password <pass>, detail full

These look correct to me.

What's probably happening is you don't have the right startup options.  Try 
this in /etc/rc.conf:

barnyard_enable="YES"
barnyard_conf="/usr/local/etc/barnyard.conf"
barnyard_flags="-c /usr/local/etc/barnyard.conf -d /var/log/snort/ -f 
snort.log w /usr/local/etc/waldo.file -X by_snort"

(adjust the paths according to your config)

A common mistake is to do this:
barnyard -c barnyard.conf -d /var/log/snort/snort.log

That will make barnyard segfault sometimes.

The -d switch is for the *directory* where the log files are.  You must 
also use the -f switch for the *name* of the log files.

Paul Schmehl (pauls@xxxxxxxxxxxx)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click