I installed the port from the FreeBSD ports tree:
/usr/ports/security/barnyard
and from looking at the brief description, it does have your email
address as the maintainer so the answer would be yes.
unless it's something goofy with one of my config files
(snort,barnyard,etc), but I didn't dwell on that too much as it worked
fine as a batch file process.
I'll admit that I haven't looked at any documentation that came with
barnyard. I've been looking over a few chapters on it in a "Snort 2.1
2nd ed" book and the "Snort for dummies" book.
Scott
>>> Paul Schmehl <pauls@xxxxxxxxxxxx> 6/29/2005 4:45:44 PM >>>
Did you install barnyard from my port? Or from source?
--On Wednesday, June 29, 2005 15:36:52 -0500 Scott Foss
<Scott.Foss@xxxxxxxxxxxxxxxxxxxx> wrote:
> Hi,
>
> I'm new to Barnyard, just installed it today. I've had Snort
running
> for close to a year now with it logging to syslog and mysql. With
the
> installation of Barnyard today, I was hoping to have that do the
logging
> for me. But I've run into a small snag.
>
> For more background info, I'm running FreeBSD 4.11 along with Snort
> 2.3.0 and Barnyard 0.2.0
>
> When I run Barnyard in single file batch process mode it works fine,
I
> get the data sent to my syslog server and the mysql database.
>
> barnyard -c /usr/local/etc/barnyard.conf -o
> /var/log/snort/snort.alert.1120071651
>
> However when I try to run it in continual-processing mode...I
> immediately get a Segmentation Fault and a barnyard core dump.
>
> barnyard -w /usr/local/etc/barn.waldo -c
> /usr/local/etc/barnyard.conf -f /var/log/snort/snort.alert
>
>
> I did a quick search through the archives and noticed someone else
had
> a similar problem, but they were including the timestamp on their
> "snort.alert" file when they tried to run in continual-processing
mode.
> There was one replier that said to get rid of the timestamp, as it
> wasn't needed for continual-processing mode. As you can see from
the
> above examples of what I used to start barnyard....I haven't
included
> the timestamp yet I still get a core dump in continual-processing
mode.
>
>
> I have all other logging commented out in my snort.conf file, and
the
> following is my entry for unified logging.
>
>#
> output alert_unified: filename snort.alert, limit 128
># output log_unified: filename snort.log, limit 128
>#
>
>
> The following is a snippet from my barnyard.conf file.
>
>#
> config sid-msg-map: /usr/local/share/snort/bleeding-sid-msg.map
># config sid-msg-map: /usr/local/etc/sid-msg.map
> config gen-msg-map: /usr/local/etc/gen-msg.map
> config class-file: /usr/local/share/snort/classification.config
># use localtime instead of UTC (*not* recommended because of
> timewarps)
> config localtime
># set the hostname (currently only used for the acid db output
plugin)
> config hostname: localhost
># set the interface name (currently only used for the acid db output
> plugin)
> config interface: xl1
># set the filter (currently only used for the acid db output plugin)
># config filter: not port 22
> output alert_fast: /var/log/snort/alerts.out
> output log_dump
> output alert_syslog: LOG_LOCAL3 | LOG_ALERT | LOG_PID
> output alert_acid_db: mysql, database snort, server localhost, user
> snortusername, password snortpassword, detail full
>#
>
> I don't understand the problem I'm having as it works fine in batch
> file mode. I have tried continual-processing mode with and without
the
> waldo file and that makes no difference at all. I really need the
live
> logging, so batch processing is not a good option for me. If I
can't
> get barnyard working properly in continual-processing mode I will
have
> to go back to having Snort do all the logging for me.
>
> If anyone can point out what I'm doing wrong it'd be appreciated.
>
>
> Thanks,
>
> Scott
>
>
>
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration
Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
> _______________________________________________
> Barnyard-users mailing list
> Barnyard-users@xxxxxxxxxxxxxxxxxxxxx
> https://lists.sourceforge.net/lists/listinfo/barnyard-users
Paul Schmehl (pauls@xxxxxxxxxxxx)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/
-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
_______________________________________________
Barnyard-users mailing list
Barnyard-users@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/barnyard-users
-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
|
