I run several instances of Snort on SuSE Linux (to monitor traffic on
2-3 NICs) and I have been logging directly to a MySQL database. I would
like to start using the unified output and barnyard. I have it working
for the most part, the problem is I have a unified output file for each
interface that I have snort listening on and I can't get multiple
instances of barnyard to run in continuous mode to process each log
file.
I'd prefer to run barnyard in batch mode in 10 minute intervals on each
log file, I can't seem to do that either without restarting snort each
time after I run barnyard to create a new unified log file.
Is there a way to run barnyard in batch mode so that each time it's run
against a file it only processes events that it hasn't processed before?
Or, is there a way to have multiple continuous instances of barnyard
running so each instance can maintain its corresponding snort unified
log file?
Or, is there a better way to have each event captured by snort
associated with the network interface it was detected on?
SuSE Enterprise 9
Snort 2.4.5
Barnyard 0.2.0
Thanks,
Spencer
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
