Barnyard stops transmitting events

Hi,

 

Over the past weeks I have inherited the maintenance of a multiple sensor snort/barnyard NIDS. When it is up and running it works very well but after several days of unattended running (like over a weekend, esp. long weekends) I see that sensors are dropping out of my database reports. Upon investigation, I find that snort is happily running and the barnyard daemon is running also. However, there are alerts in the /opt/short_data/alert file that are not forwarded to the database. If I restart the services, all of the events in arrears are transmitted.

 

Can anyone shed some light on why this might be happening? The process seems to be in a normal state but it is not transmitting.

 

Thanks in advance.

 

Thomas Ruppel, CISSP

Contractor

office 301-594-1053

cell 301-204-2015

Senior Network Security Engineer

Office of Information Technology(OIT) - EO/OD/NIH/DHHS

 

 

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/_______________________________________________
Barnyard-users mailing list
Barnyard-users@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/barnyard-users