Barnyard not Updating MySQL

["Someone.you dont.like" <maps.this.address () gmail com>]

Hi,

I am trying to get Barnyard to work in conjunction with Snort to
update to MySQL backend database. All three programs are run on a same
system (localhost) and I am using the following versions:

Barnyard : 
/usr/local/barnyard/bin/barnyard -V
Barnyard Version 0.2.0 (Build 32)

Snort:
/usr/local/snort/bin/snort -V

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.4.0 (Build 18)
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/team.html
           (C) Copyright 1998-2005 Sourcefire Inc., et al.

MySQL:
/usr/local/mysql/bin/mysql -V
/usr/local/mysql/bin/mysql  Ver 14.7 Distrib 4.1.13a, for pc-linux-gnu
(i686) using  EditLine wrapper

OS:
Slackware 10.1 (kernel 2.6.11.3)

When I configure Snort to update the database directly without
Barnyard, it "does" write accordingly in real time as I run portscan
or some other type attack that would trigger a rule. But when I
attempt to configure Barnyard to process the log files into the
database, I see no event table being updated (same type of attack,
i.e. Stealth SYN port scan...).

A few thing before I go on:
Snort, Barnyard, map, and classification files are under /etc/snort
Log files are under /var/log/snort

*****************
*      snort.conf     *
*****************
I have the following in my /etc/snort/snort.conf:
output alert_unified: filename snort-unified.alert, limit 128
output log_unified: filename snort-unified.log, limit 128

And the MySQL database line is "commented".

*********************
*      barnyard.conf     *
*********************
In /etc/snort/barnyard.conf I have:
config daemon
#config localtime
config hostname: localhost
config interface: bridge0
config filter: not port 22
output alert_fast
output log_dump
output alert_csv: csv.out
timestamp,msg,srcip,sport,dstip,dport,protoname,i\type,icode
output log_pcap
output log_acid_db: mysql, sensor_id 1, database snort, server
localhost, user snort, password [EDITED], detail full
output alert_acid_db: mysql, sensor_id 1, database snort, server
localhost, user snort, password [EDITED], detail full

The passwords are double and triple checked. They work with Snort and
MySQL commandline.

*******************
*     Snort exec        *
*******************
Here's how I run Snort:
/usr/local/snort/bin/snort -dev -u snort -q -c /etc/snort/snort.conf
-i eth0 -l /var/log/snort -D

**************************
*        Barnyard exec           *
**************************
And Barnyard:
/usr/local/barnyard/bin/barnyard -c /etc/snort/barnyard.conf -s
/etc/snort/sid-msg.map -g /etc/snort/gen-msg.map -p
/etc/snort/classification.config -d /var/log/snort/ -f
snort-unified.log -X /var/run/by.pid -w /etc/snort/waldo.file -v -v -v
-v -v -v -D

With the following screen output by Barnyard (verbose mode):
Barnyard Version 0.2.0 (Build 32)
Command line arguments:
  Config file:           /etc/snort/barnyard.conf
  Spool dir:             /var/log/snort/
  Gen-msg file:          /etc/snort/gen-msg.map
  Sid-msg file:          /etc/snort/sid-msg.map
  Class file:            /etc/snort/classification.config
  Log dir:               Not specified
  Archive dir:           Not specified
  File base:             snort-unified.log
  Waldo file:            /etc/snort/waldo.file
  Pid file:              /var/run/by.pid
  Verbosity level:       6
  Dry run flag:          Not Set
  Batch mode flag:       Not Set
  Daemon flag:           Set
  New records only flag: Not Set
  Usage flag:            Not Set
  Version flag:          Not Set
Config file variables:
  Hostname:        localhost
  Interface:       bridge0
  BPF Filter:      not port 22
  Class file:      Not specified
  Sid-msg file:    Not specified
  Gen-msg file:    Not specified
  Daemon flag:     Set
  Localtime flag:  Not Set
Program Variables:
  Continual processing mode
  Config dir:    /etc/snort
  Config file:   /etc/snort/barnyard.conf
  Sid-msg file:  /etc/snort/sid-msg.map
  Gen-msg file:  /etc/snort/gen-msg.map
  Class file:    /etc/snort/classification.config
  Hostname:      localhost
  Interface:     bridge0
  BPF Filter:    not port 22
  Log dir:       /var/log/snort
  Verbosity:     6
  Localtime:     0
  Spool dir:     /var/log/snort/
  Spool file:    snort.alert
  Pid file:      /var/run/by.pid
  Bookmark file: /etc/snort/waldo.file
  Record Number: 6
  Timet:         1125274341
  Start at end:  0

********************
*       waldo.file          *
********************
The content of waldo.file after startup of Barnyard is:
cat /etc/snort/waldo.file 
/var/log/snort/ 
snort.alert 
1125274341
6

**************************
*        /var/log/message       *
**************************
Aug 29 12:19:08 [EDITED] barnyard: Starting data processing using
information from bookmark file
Aug 29 12:19:08 [EDITED] barnyard: WARNING: Using spool file from bookmark file
Aug 29 12:19:09 [EDITED] barnyard[21484]: Initializing daemon mode
Aug 29 12:19:09 [EDITED] barnyard[21485]: Opened spool file
'/var/log/snort//snort.alert.1125274341'
Aug 29 12:19:09 [EDITED] barnyard[21485]: OpAlertFast configured
Aug 29 12:19:09 [EDITED] barnyard[21485]:   Filename: fast.alert
Aug 29 12:19:09 [EDITED] barnyard[21485]: OpAlertCSV configured
Aug 29 12:19:09 [EDITED] barnyard[21485]:   Filepath: csv.out
Aug 29 12:19:09 [EDITED] barnyard[21485]:   Format: timestamp, msg,
srcip, sport, dstip, dport, protoname, itype, icode
Aug 29 12:19:09 [EDITED] barnyard[21485]: Waiting for new data


The log files do get written to from what I see:
ls -la /var/log/snort/ 
total 126 drwxr-xr-x   3 snort snort   472 2005-08-29 12:14 ./
drwxr-xr-x  12 root  root   1576 2005-08-28 04:40 ../
drwx------   2 snort snort   112 2005-08-28 20:23 192.168.0.174/
-rw-------   1 snort snort 61144 2005-08-29 12:09 alert
-rw-r--r--   1 snort snort 10548 2005-08-29 12:07 fast.alert
-rw-------   1 snort snort   272 2005-08-29 12:15 snort-unified.alert.1125332058
-rw-------   1 snort snort   488 2005-08-29 12:15 snort-unified.log.1125332058
-rw-------   1 snort snort   400 2005-08-28 21:16 snort.alert.1125274341
-rw-------   1 snort snort  3848 2005-08-28 22:54 snort.log.1125280475
-rw-------   1 snort snort  5824 2005-08-28 23:37 snort.log.1125286059
-rw-------   1 snort snort  5128 2005-08-29 02:15 snort.log.1125292589
-rw-------   1 snort snort   488 2005-08-29 02:17 snort.log.1125296165
-rw-------   1 snort snort 16321 2005-08-29 12:09 snort.log.1125296354

 After portscan:
ls -la /var/log/snort/
total 126
drwxr-xr-x   3 snort snort   472 2005-08-29 12:14 ./
drwxr-xr-x  12 root  root   1576 2005-08-28 04:40 ../
drwx------   2 snort snort   112 2005-08-28 20:23 192.168.0.174/
-rw-------   1 snort snort 61144 2005-08-29 12:09 alert
-rw-r--r--   1 snort snort 10548 2005-08-29 12:07 fast.alert
-rw-------   1 snort snort   528 2005-08-29 12:18 snort-unified.alert.1125332058
-rw-------   1 snort snort   952 2005-08-29 12:18 snort-unified.log.1125332058
-rw-------   1 snort snort   400 2005-08-28 21:16 snort.alert.1125274341
-rw-------   1 snort snort  3848 2005-08-28 22:54 snort.log.1125280475
-rw-------   1 snort snort  5824 2005-08-28 23:37 snort.log.1125286059
-rw-------   1 snort snort  5128 2005-08-29 02:15 snort.log.1125292589
-rw-------   1 snort snort   488 2005-08-29 02:17 snort.log.1125296165
-rw-------   1 snort snort 16321 2005-08-29 12:09 snort.log.1125296354


The weird thing is the waldo.file shows snort.alert.1125274341. I do
not know whether that has something to do with it; please correct me
if I'm wrong. This is how I check the event table:
[Before portscan]:
mysql> select count(*) from event;
+----------+
| count(*) |
+----------+
|       60 |
+----------+
1 row in set (0.00 sec)

[A few minutes later after the portscan]
mysql> select count(*) from event;
+----------+
| count(*) |
+----------+
|       60 |
+----------+
1 row in set (0.00 sec)
 
In case of Snort only updating the database, I can actually see the
event table growing in real time.


Anyway, I've tried to run Snort and Barnyard with only log or alert
file updates, still Barnyard doesn't update the database. The sensor
id is 1:
mysql> select * from sensor;
+-----+---------------+-----------+--------+--------+----------+----------+
| sid | hostname      | interface | filter | detail | encoding | last_cid |
+-----+---------------+-----------+--------+--------+----------+----------+
|   1 | 192.168.2.134 | eth0      | NULL   |      1 |        0 |       56 |
+-----+---------------+-----------+--------+--------+----------+----------+
1 row in set (0.04 sec)

I have also tried sensor_id 0 and 2 in my barnyard.conf, no luck!

Ok, one last thing, the log files are indeed in unified format because
when I run Barnyard in batch mode, it process them accordingly and I
get:
/usr/local/barnyard/bin/barnyard -o -c /etc/snort/barnyard.conf -s
/etc/snort/sid-msg.map -g /etc/snort/gen-msg.map -p
/etc/snort/classification.config 
/var/log/snort/snort-unified.alert.1125332058
Barnyard Version 0.2.0 (Build 32)
Exiting
[user]@[somehost]:~/blah# ls
csv.out  fast.alert

I hope I pretty much covered everything that I could. Any ideas?

Any help would be much appreciated.


-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users