-f snort.alert is for input to barnyard. It tells barnyard to look for
snort.alert.[timestamp] for use when reading unified output from snort.
You will then have to have an alert capable output module configured for
barnyard and a unified alert output line for snort to do something with
that data.
EG: in barnyard.conf
output alert_fast
would create classic text files based on alert data.
To completely answer your question we would need to see the
barnyard.conf file and you output directives from snort.conf
Brian Krusic wrote:
Hi,
I've a question regarding barnyard (I happen to call one of my best
friends by this name :)
I'm not sure what to do with the results.
My command line;
barnard -c /usr/local/barnyard/etc/barnyard.conf -d /var/log/snort -g
/usr/local/snort/etc/gen-msg.map -s /usr/local/snort/etc/sid-msg.map -f
snort.alert
I pretty much got this from the barnyard USAGE file but don't understand
the -f option as I expect to see a snort.alert file.
I do see info in both the gen-msg.map and sid-msg.map files but am not
sure wether I am supposed to filter or tail or cat these files.
The reason I'd like to use barnyard is that;
1) I've a gig e network and the manual says that you may want to use
some kind of binary reader in this case for speed.
2) I'd rather not use the console output as it can be slow.
3) with barnyard I have the option of picking up where I left off in the
event of a crashed program or system and don't have to look at the
entire output from the begining.
Thanks in advance,
Bri-
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
