Search Results

Search found 6 results on 1 pages for 'barnyard2'.

Page 1/1 | 1 

• install barnyard2 ubuntu 12.04

  - by Muhammad Ardiansyah

  I trying to install barnyard2 in ubuntu 12.04 32-bit I'm configure using syntax: ./configure --with-mysql-libraries=/usr/lib/x86_64-linux-gnu and when I trying to compile daq-1.1.1 using a makefile, I encountered the following errors: make[3]: Leaving directory /root/snortinstall/barnyard2/src' make[2]: Leaving directory/root/snortinstall/barnyard2/src' Making all in etc make[2]: Entering directory /root/snortinstall/barnyard2/etc' make[2]: Nothing to be done forall'. make[2]: Leaving directory /root/snortinstall/barnyard2/etc' Making all in doc make[2]: Entering directory/root/snortinstall/barnyard2/doc' make[2]: Nothing to be done for all'. make[2]: Leaving directory /root/snortinstall/barnyard2/doc' Making all in rpm make[2]: Entering directory /root/snortinstall/barnyard2/rpm' make[2]: Nothing to be done forall'. make[2]: Leaving directory /root/snortinstall/barnyard2/rpm' Making all in schemas make[2]: Entering directory/root/snortinstall/barnyard2/schemas' make[2]: Nothing to be done for all'. make[2]: Leaving directory /root/snortinstall/barnyard2/schemas' Making all in m4 make[2]: Entering directory /root/snortinstall/barnyard2/m4' make[2]: Nothing to be done forall'. make[2]: Leaving directory /root/snortinstall/barnyard2/m4' make[2]: Entering directory /root/snortinstall/barnyard2' make[2]: Nothing to be done for all-am'. make[2]: Leaving directory/root/snortinstall/barnyard2' make[1]: Leaving directory `/root/snortinstall/barnyard2'

  Read the article

• Snort/Barnyard2 Logging

  - by Eric

  I need some help with my Snort/Barnyard2 setup. My goal is to have Snort send unified2 logs to Barnyard2 and then have Barnyard2 send the data to other locations. Here is my currrent setup. OS Scientific Linux 6 Snort Version 2.9.2.3 Barnyard2 Version 2.1.9 Snort command snort -c /etc/snort/snort.conf -i eth2 & Barnyard2 command /usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -w /var/log/snort/barnyard.waldo & snort.conf output unified2: filename snort.log, limit 128 barnyard2.conf output alert_syslog: host=127.0.0.1 output database: log, mysql, user=snort dbname=snort password=password host=localhost With this setup, barnyard2 is showing all of the correct information in the database and I'm using BASE to view it on the web GUI. I was hoping to be able to send the full packet data to syslog with barnyard2 but after reading around, it seems that it is impossible to do that. So I then started trying to modify the snort.conf file and add lines like "output alert_full: alert.full". This definitely gave me a lot more information but still not the full packet data like I want. So my question is, is there anyway I can use barnyard2 to send the full packet data of alerts to a human readable file? Since I can't send it directly to syslog, I can create another process to take the data from that file and ship it off to another server. If not, what flags and/or snort.conf configuration would you recommend to get the most data possible but still be able to handle quite a bit of traffic? In the end of it all, these alerts will be shipped to a central server via a SSH tunnel. I'm trying to stay away from databases.

  Read the article

• Snort/Barnyard2-1.10 LOG_SYSLOG_FULL Output Logging

  - by Ron

  With log_syslog_full opertion mode set to complete you get the below output. Can some explain to me what the bold parts are? I have been searching and cannot find any documention explaining the new file output format. Thanks | [SNORTIDS[LOG]: [IDS1] ] || 2012-11-28 20:31:31.747+-06 1 [1:2803567:3] ETPRO POLICY Suspicious User-Agent (LuaSocket) || trojan-activity || 6 69.2.42.86 64.129.104.173 5 0 0 146 38060 0 0 3635 0 || 41848 80 4082109343 3023118530 8 0 24 32768 39439 0 || 160 00000C07AC050023EBABC57A08004500009294AC0000FF060E3345022A56408168ADA3780050F3500B9FB43120C2801880009A0F00000101080A3198E2CD00000000686F73743A20757064617465732E69726F6E706F72742E636F6D0D0A757365722D6167656E743A204C7561536F636B657420322E300D0A74653A20747261696C6572730D0A636F6E6E656374696F6E3A20636C6F73652C2054450D0A0D0A ||

  Read the article

• snort with barnyard2 not working on Fedora 12

  - by aHunter

  Has anyone come across this error with barnyard2 and snort? --== Initializing Barnyard2 ==-- Initializing Input Plugins! Initializing Output Plugins! Parsing config file "/etc/snort/barnyard2.conf" Log directory = /var/log/barnyard2 database: compiled support for (mysql) database: configured to use mysql database: schema version = 107 database: host = localhost database: user = test database: database name = snort database: sensor name = localhost:eth0 database: sensor id = 1 database: data encoding = hex database: detail level = full database: ignore_bpf = no database: using the "log" facility --== Initialization Complete ==-- ______ -*> Barnyard2 <*- / ,,_ \ Version 2.1.8 (Build 251) |o" )~| By the SecurixLive.com Team: http://www.securixlive.com/about.php + '''' + (C) Copyright 2008-2010 SecurixLive. Snort by Martin Roesch & The Snort Team: http://www.snort.org/team.html (C) Copyright 1998-2007 Sourcefire Inc., et al. WARNING: Ignoring corrupt/truncated waldofile '/var/log/snort/barnyard.waldo' Opened spool file '/var/log/snort/snort.log.1282004944' ERROR: Unknown record type read: 104 Fatal Error, Quitting.. Snort seems to be working correctly as I have managed to get logs via syslog but when I try to use the barnyard config via Unified2 it is not working. Presumably because of the above error. Thanks in advance.

  Read the article

• Barnyard Service - MySQL Error

  - by SLYN

  I installed barnyard2 and saved as a service. When I run service barnyard2 start, Barnyard2 is failed. After I run tail -100 /var/log/messages and I encounter a fault like this. ERROR database: 'mysql' support is not compiled into this build of snort#012 Aug 22 11:52:06 barnyard2[25771]: FATAL ERROR: If this build of barnyard2 was obtained as a binary distribution (e.g., rpm,#012or Windows), then check for alternate builds that contains the necessary#012'mysql' support.#012#012If this build of barnyard2 was compiled by you, then re-run the#012the ./configure script using the '--with-mysql' switch.#012For non-standard installations of a database, the '--with-mysql=DIR'#012syntax may need to be used to specify the base directory of the DB install.#012#012See the database documentation for cursory details (doc/README.database).#012and the URL to the most recent database plugin documentation. Aug 22 11:52:06 barnyard2[25771]: Barnyard2 exiting What sould I do for solving this problem? When I installed Barnyard2, I used these commands: # ./configure --with-mysql --with-mysql-libraries=/usr/lib64/mysql # make ; make install (My System is CentOS 6.5 x86_64.)

  Read the article

• gen-msg.map missing in Snort rules?

  - by TheLQ

  I am trying to install Snort 2.8.4.1 (only package available in the repos) with Barnyard2 with limited success. I've managed to fix everything but this: [lordquackstar@quackwall rules]$ sudo barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.u2 -w /etc/snort/barny Password: Running in Continuous mode --== Initializing Barnyard2 ==-- Initializing Input Plugins! Initializing Output Plugins! Parsing config file "/etc/snort/barnyard2.conf" ERROR: Unable to open Generator file "/etc/snort/gen-msg.map": No such file or directory ERROR: Stat check on log dir (/var/log/barnyard2) failed: No such file or directory. Fatal Error, Quitting.. The gen-msg.map error is puzzling me. The rulesets that come with the package do not contain this file. The newish rules I just downloaded from Snort.org for version 2.8.6.1 don't have this file. The only file that looks close is called sid-msg.map, but that's the wrong one. Where can I obtain this file? Just in case it matters: The packages come from the ClearOS repositories (OS is based off of CentOS). I'm running CentOS 5.2

  Read the article

1