Hello Roland,
Friday, August 19, 2005, 1:50:11 PM, you wrote:
When I run barnyard to monitor unified log - no events stored in DB.
Please, anybody can help me to configure barnyard?
RTS> At this point, we probably need to see your snort and barnyard
RTS> configuration files.
- >8 - - >8 - - >8 - part of snort.conf - >8 - - >8 - - >8 -
output alert_unified: filename snort.alert, limit 128
output log_unified: filename snort.log, limit 128
- >8 - - >8 - - >8 - part of snort.conf - >8 - - >8 - - >8 -
- >8 - - >8 - - >8 - part of barnyard.conf - >8 - - >8 - - >8 -
output alert_acid_db: mysql, sensor_id 1, database snort, server xxxx, user
xxxx, password xxxx
output log_acid_db: mysql, sensor_id 1, database snort, server xxxx, user xxxx,
password xxxx, detail full
- >8 - - >8 - - >8 - part of barnyard.conf - >8 - - >8 - - >8 -
- >8 - - >8 - - >8 - part of running script - >8 - - >8 - - >8 -
SNORT_BIN=/usr/local/snort/bin/snort
SNORT_CONF=/usr/local/snort/etc/snort.conf
SNORT_LOG=/var/log/snort
BARNYARD_BIN=/usr/local/barnyard/bin/barnyard
BARNYARD_CONF=/usr/local/barnyard/etc/barnyard.conf
startproc $SNORT_BIN -d -D -i any -l $SNORT_LOG -c $SNORT_CONF
startproc $BARNYARD_BIN -D -c $BARNYARD_CONF -d $SNORT_LOG -f snort.alert -w
$SNORT_LOG/barnyard.waldo
- >8 - - >8 - - >8 - part of running script - >8 - - >8 - - >8 -
(-g, -s and -p in barnyard cmdline are omitted in above example)
When I use "-f snort.alert" - I get alert events in DB, but don't get
payload. When I use "-f snort.log" - I don't get alert events in DB.
--
Best regards,
Igor mailto:ivb@is.ua
-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
