Ok, I have no idea why this is....but thankfully I fumbled across the
solution to my problem this morning (new day).
I changed how I was starting barnyard for continual processing mode,
instead of having the directory and filename together (which worked fine
in batch process mode), I split them up and it worked.
I was trying to start it with:
barnyard -c /usr/local/etc/barnyard.conf -f
/var/log/snort/snort.alert
That would give me a segmentation fault right away.
But when I changed over to use the following, everything worked.
barnyard -c /usr/local/etc/barnyard.conf -d /var/log/snort/ -f
snort.alert
Go figure....on my system it wanted the directory specified all by
itself and the unified log file all by itself in order to work.
Now I just have to start it as a daemon, and I should be off and
running. ...and I'll add the correct entries into my rc.conf file too.
Thanks for the help and replies!
Scott
>>> Paul Schmehl <pauls@xxxxxxxxxxxx> 6/29/2005 5:51:06 PM >>>
I'm not positive, but I don't believe you can log to a db and unified
log
file at the same time. Try commenting out one or the other and see if
that
solves the problem. If it does, just run two instances of barnyard.
--On Wednesday, June 29, 2005 17:40:35 -0500 Scott Foss
<Scott.Foss@xxxxxxxxxxxxxxxxxxxx> wrote:
> I installed the port from the FreeBSD ports tree:
> /usr/ports/security/barnyard
>
> and from looking at the brief description, it does have your email
> address as the maintainer so the answer would be yes.
>
> unless it's something goofy with one of my config files
> (snort,barnyard,etc), but I didn't dwell on that too much as it
worked
> fine as a batch file process.
>
> I'll admit that I haven't looked at any documentation that came with
> barnyard. I've been looking over a few chapters on it in a "Snort
2.1
> 2nd ed" book and the "Snort for dummies" book.
>
>
> Scott
>
>
>
>
>>>> Paul Schmehl <pauls@xxxxxxxxxxxx> 6/29/2005 4:45:44 PM >>>
> Did you install barnyard from my port? Or from source?
>
> --On Wednesday, June 29, 2005 15:36:52 -0500 Scott Foss
> <Scott.Foss@xxxxxxxxxxxxxxxxxxxx> wrote:
>
>> Hi,
>>
>> I'm new to Barnyard, just installed it today. I've had Snort
> running
>> for close to a year now with it logging to syslog and mysql. With
> the
>> installation of Barnyard today, I was hoping to have that do the
> logging
>> for me. But I've run into a small snag.
>>
>> For more background info, I'm running FreeBSD 4.11 along with Snort
>> 2.3.0 and Barnyard 0.2.0
>>
>> When I run Barnyard in single file batch process mode it works
fine,
> I
>> get the data sent to my syslog server and the mysql database.
>>
>> barnyard -c /usr/local/etc/barnyard.conf -o
>> /var/log/snort/snort.alert.1120071651
>>
>> However when I try to run it in continual-processing mode...I
>> immediately get a Segmentation Fault and a barnyard core dump.
>>
>> barnyard -w /usr/local/etc/barn.waldo -c
>> /usr/local/etc/barnyard.conf -f /var/log/snort/snort.alert
>>
>>
>> I did a quick search through the archives and noticed someone else
> had
>> a similar problem, but they were including the timestamp on their
>> "snort.alert" file when they tried to run in continual-processing
> mode.
>> There was one replier that said to get rid of the timestamp, as it
>> wasn't needed for continual-processing mode. As you can see from
> the
>> above examples of what I used to start barnyard....I haven't
> included
>> the timestamp yet I still get a core dump in continual-processing
> mode.
>>
>>
>> I have all other logging commented out in my snort.conf file, and
> the
>> following is my entry for unified logging.
>>
>>#
>> output alert_unified: filename snort.alert, limit 128
>># output log_unified: filename snort.log, limit 128
>>#
>>
>>
>> The following is a snippet from my barnyard.conf file.
>>
>>#
>> config sid-msg-map: /usr/local/share/snort/bleeding-sid-msg.map
>># config sid-msg-map: /usr/local/etc/sid-msg.map
>> config gen-msg-map: /usr/local/etc/gen-msg.map
>> config class-file: /usr/local/share/snort/classification.config
>># use localtime instead of UTC (*not* recommended because of
>> timewarps)
>> config localtime
>># set the hostname (currently only used for the acid db output
> plugin)
>> config hostname: localhost
>># set the interface name (currently only used for the acid db output
>> plugin)
>> config interface: xl1
>># set the filter (currently only used for the acid db output plugin)
>># config filter: not port 22
>> output alert_fast: /var/log/snort/alerts.out
>> output log_dump
>> output alert_syslog: LOG_LOCAL3 | LOG_ALERT | LOG_PID
>> output alert_acid_db: mysql, database snort, server localhost, user
>> snortusername, password snortpassword, detail full
>>#
>>
>> I don't understand the problem I'm having as it works fine in batch
>> file mode. I have tried continual-processing mode with and without
> the
>> waldo file and that makes no difference at all. I really need the
> live
>> logging, so batch processing is not a good option for me. If I
> can't
>> get barnyard working properly in continual-processing mode I will
> have
>> to go back to having Snort do all the logging for me.
>>
>> If anyone can point out what I'm doing wrong it'd be appreciated.
>>
>>
>> Thanks,
>>
>> Scott
>>
>>
>>
>> -------------------------------------------------------
>> SF.Net email is sponsored by: Discover Easy Linux Migration
> Strategies
>> from IBM. Find simple to follow Roadmaps, straightforward articles,
>> informative Webcasts and more! Get everything you need to get up to
>> speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
>
>> _______________________________________________
>> Barnyard-users mailing list
>> Barnyard-users@xxxxxxxxxxxxxxxxxxxxx
>> https://lists.sourceforge.net/lists/listinfo/barnyard-users
>
>
>
> Paul Schmehl (pauls@xxxxxxxxxxxx)
> Adjunct Information Security Officer
> University of Texas at Dallas
> AVIEN Founding Member
> http://www.utdallas.edu/ir/security/
>
>
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration
Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
> _______________________________________________
> Barnyard-users mailing list
> Barnyard-users@xxxxxxxxxxxxxxxxxxxxx
> https://lists.sourceforge.net/lists/listinfo/barnyard-users
>
>
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration
Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
> _______________________________________________
> Barnyard-users mailing list
> Barnyard-users@xxxxxxxxxxxxxxxxxxxxx
> https://lists.sourceforge.net/lists/listinfo/barnyard-users
Paul Schmehl (pauls@xxxxxxxxxxxx)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/
-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
|
