--On August 20, 2005 12:44:35 AM -0500
eric-list-snort-users@catastrophe.net wrote:
My barnyard.conf is as follows...
config localtime
config hostname: gw1
config interface: bridge0
config filter: not port 22
output log_acid_db: mysql, database snort, server 10.19.81.137,
user foo, password bar, detail full [wrapped for clarity]
Next I start barnyard in the following manner...
# /var/snort/bin/barnyard -c /var/snort/etc/barnyard.conf \
-s /var/snort/etc/sid-msg.map -g /var/snort/etc/gen-msg.map \
-p /var/snort/etc/classification.config -d /var/snort/log \
-f snort.log -w /var/snort/log/snort_ids.log
You can add the following to the config section of your barnyard conf file:
config sid-msg-map: /usr/local/share/snort/sid-msg.map
config gen-msg-map: /usr/local/share/snort/gen-msg.map
config class-file: /usr/local/share/snort/classification.config
(adjust the paths to the files to match your locations)
which will allow you to reduce your barnyard startup to the following:
# /var/snort/bin/barnyard -c /var/snort/etc/barnyard.conf \
-d /var/snort/log -f snort.log -w /var/snort/log/snort_ids.log
WARNING: Bookmark file is corrupt, only processing new events
Delete your waldo file (/var/log/snort/log/snort_ids.log) and allow
barnyard to recreate it. It's apparently corrupted.
I also strongly recommend that you do not use localtime with barnyard. It
causes problems during the change from daylight savings to "normal" time.
Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/
-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
