Snort mailing list archives
Re: Need help in getting barnyard and Snort to work together
From: "sudhakar govindavajhala" <sudhakarg79spam () gmail com>
Date: Wed, 30 Jan 2008 19:01:48 -0500
Thanks Paul, please read on.
2) As I noticed, each time Snort is restarted, the log file name changes. For example, snort.log.1201695424 to snort.log.12016923232. Why? Change
in
log file name implies that barnyard.waldo needs to change every time there
is
a reboot, making configurations unstable.
That's normal behavior and has no ill effects. OK. Does it mean I need to change the waldo config file each time my computer reboots or Snort restarts?
Can you tell me what I need to do from here to be able to automate Snort
and
barnyard?
Without knowing what OS you're using? Not likely. SG: Red Hat EL 4 --Sudhakar BTW, if you read the source code for base, you'll discover that you can add this to the barnyard.conf file and eliminate some of the long commandline when you start barnyard. config class-file: /usr/local/etc/snort/classification.config config sid-msg-map: /usr/local/etc/snort/sid-msg.map config gen-msg-map: /usr/local/etc/snort/gen-msg.map (Change the paths to fit your OS.) So, having done that, you could start barnyard like this: barnyard -D -c /etc/barnyard.conf -d /path-to/snort.log-directory -f snort.log -w path-to/waldo.file Barnyard will figure out which log file to open and keep track of where it's at in the waldo file. -- Paul Schmehl (pauls () utdallas edu) Senior Information Security Analyst The University of Texas at Dallas http://www.utdallas.edu/ir/security/ ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Need help in getting barnyard and Snort to work together sudhakar govindavajhala (Jan 30)
- Re: Need help in getting barnyard and Snort to work together Paul Schmehl (Jan 30)
- Re: Need help in getting barnyard and Snort to work together sudhakar govindavajhala (Jan 30)
- Re: Need help in getting barnyard and Snort to work together Paul Schmehl (Jan 31)
- Re: Need help in getting barnyard and Snort to work together sudhakar govindavajhala (Jan 30)
- Re: Need help in getting barnyard and Snort to work together Paul Schmehl (Jan 30)