Hello Roland,
Friday, August 19, 2005, 12:36:45 PM, you wrote:
1. In archive of this mailing list I read that unified alert file
contains only alerts information, and unified log file contains both
alerts and corresponding payloads. But documentation says different:
unified log contains only payload, and I confirmed this by some
tests.
RTS> The unified log format does not contain broken out fields for
RTS> protocol-number or src/dest ip-address/port-number, while the unified
RTS> alert format does. This information is, however, still available in the
RTS> payload in the unified log format. The gen:sid:rev, classification,
RTS> priority, eventid and timestamps are presented identically in both formats
RTS> as part of the Event struct.
It's sounds good for me, but I can't correctly configure barnyard to
extract all needing info from unified log.
When I run barnyard to monitor unified log - no events stored in DB.
Please, anybody can help me to configure barnyard?
--
Best regards,
Igor mailto:ivb@is.ua
-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
