--On Wednesday, August 23, 2006 09:41:05 -0500 Spencer Anderson
<sanderson@clearnorthtech.com> wrote:
Is there a way to run barnyard in batch mode so that each time it's run
against a file it only processes events that it hasn't processed before?
Barnyard does this by default, but you can specify a waldo file if you
like.
Or, is there a way to have multiple continuous instances of barnyard
running so each instance can maintain its corresponding snort unified
log file?
Sure. I run three on one box. Just create symlinks to the binary -
barnyard1, barnyard2 and barnyard3. Then create duplicate startup scripts
with the right switches for each instance, etc. The pidfiles should be
named after each instance so one doesn't negate another.
Or, is there a better way to have each event captured by snort
associated with the network interface it was detected on?
Start three instances of snort, each with its own interface specified.
Make sure you use the -R switch to append a character to the pid file for
each instance and specify the location of each logfile, etc., etc.
It's all very doable (I've been doing it for some time now). You just have
to think through how to separate the processes and their results so they
don't "step on" each other.
Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/
p7swJtRsQ7Kvf.p7s
Description: S/MIME cryptographic signature
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
