Snort mailing list archives
Re: Just upgraded snort - now barnyard won't run
From: Paul Schmehl <pauls () utdallas edu>
Date: Tue, 23 Jan 2007 15:25:02 -0600
I just downgraded snort to 2.6.1.1, and this problem went away. It appears there is something wrong with 2.6.1.2 that causes writes to the logs that barnyard doesn't like.
--On Tuesday, January 23, 2007 10:45:08 -0600 Paul Schmehl <pauls () utdallas edu> wrote:
I just upgraded snort to version 2.6.1.2 (FreeBSD 6.1): snort -V ,,_ -*> Snort! <*- o" )~ Version 2.6.1.2 (Build 34) FreeBSD '''' By Martin Roesch & The Snort Team: http://www.snort.org/team.html (C) Copyright 1998-2006 Sourcefire Inc., et al. Now barnyard won't start: tail /var/log/messages Jan 22 22:30:01 buttercup3 snort[56469]: Writing PID "56469" to file "/var/run//snort_bge0E.pid" Jan 22 22:30:01 buttercup3 snort[56469]: Daemon initialized, signaled parent pid: 56468 Jan 22 22:30:01 buttercup3 snort[56468]: Daemon parent exiting Jan 22 22:31:06 buttercup3 snort[56469]: Snort initialization completed successfully (pid=56469) Jan 22 22:31:06 buttercup3 snort[56469]: Not Using PCAP_FRAMES Jan 23 16:08:43 buttercup3 barnyard[68251]: Initializing daemon mode Jan 23 16:08:43 buttercup3 barnyard[68252]: Opened spool file '/var/log/snort//snort.log.1169504455' Jan 23 16:08:43 buttercup3 barnyard[68252]: ERROR: Invalid packet length: 3810967040 Jan 23 16:08:43 buttercup3 barnyard[68252]: FATAL ERROR: Read error Jan 23 16:08:43 buttercup3 barnyard[68252]: Exiting Snort.conf has: grep output /usr/local/etc/snort/snort.conf # Step #4: Configure output plugins # output alert_unified: filename snort.alert, limit 128 output log_unified: filename snort.log, limit 128 Was the spo_unified log format changed in some way? I've deleted a bunch of log files to get barnyard to start and stay running, but as soon as snort creates a new logfile, barnyard exits with a FATAL ERROR. Paul Schmehl (pauls () utdallas edu) Senior Information Security Analyst The University of Texas at Dallas http://www.utdallas.edu/ir/security/
Paul Schmehl (pauls () utdallas edu) Senior Information Security Analyst The University of Texas at Dallas http://www.utdallas.edu/ir/security/
Attachment:
_bin
Description:
------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Just upgraded snort - now barnyard won't run Paul Schmehl (Jan 23)
- Re: Just upgraded snort - now barnyard won't run Paul Schmehl (Jan 23)