I just downgraded snort to 2.6.1.1, and this problem went away. It appears
there is something wrong with 2.6.1.2 that causes writes to the logs that
barnyard doesn't like.
--On Tuesday, January 23, 2007 10:45:08 -0600 Paul Schmehl
<pauls@utdallas.edu> wrote:
I just upgraded snort to version 2.6.1.2 (FreeBSD 6.1):
snort -V
,,_ -*> Snort! <*-
o" )~ Version 2.6.1.2 (Build 34) FreeBSD
'''' By Martin Roesch & The Snort Team:
http://www.snort.org/team.html
(C) Copyright 1998-2006 Sourcefire Inc., et al.
Now barnyard won't start:
tail /var/log/messages
Jan 22 22:30:01 buttercup3 snort[56469]: Writing PID "56469" to file
"/var/run//snort_bge0E.pid"
Jan 22 22:30:01 buttercup3 snort[56469]: Daemon initialized, signaled
parent pid: 56468
Jan 22 22:30:01 buttercup3 snort[56468]: Daemon parent exiting
Jan 22 22:31:06 buttercup3 snort[56469]: Snort initialization completed
successfully (pid=56469)
Jan 22 22:31:06 buttercup3 snort[56469]: Not Using PCAP_FRAMES
Jan 23 16:08:43 buttercup3 barnyard[68251]: Initializing daemon mode
Jan 23 16:08:43 buttercup3 barnyard[68252]: Opened spool file
'/var/log/snort//snort.log.1169504455'
Jan 23 16:08:43 buttercup3 barnyard[68252]: ERROR: Invalid packet length:
3810967040
Jan 23 16:08:43 buttercup3 barnyard[68252]: FATAL ERROR: Read error
Jan 23 16:08:43 buttercup3 barnyard[68252]: Exiting
Snort.conf has:
grep output /usr/local/etc/snort/snort.conf
# Step #4: Configure output plugins
# output alert_unified: filename snort.alert, limit 128
output log_unified: filename snort.log, limit 128
Was the spo_unified log format changed in some way?
I've deleted a bunch of log files to get barnyard to start and stay
running, but as soon as snort creates a new logfile, barnyard exits with
a FATAL ERROR.
Paul Schmehl (pauls@utdallas.edu)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/
Paul Schmehl (pauls@utdallas.edu)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/
p7snY0oGkkWdz.p7s
Description: S/MIME cryptographic signature
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
