Re: Need help in getting barnyard and Snort to work together

[Paul Schmehl <pauls () utdallas edu>]

--On Wednesday, January 30, 2008 19:01:48 -0500 sudhakar govindavajhala 
<sudhakarg79spam () gmail com> wrote:

> Thanks Paul,  please read on.
>
>
> > 2) As I noticed, each time Snort is restarted, the log file name changes.
> > For example, snort.log.1201695424 to snort.log.12016923232.  Why?  Change in
> > log file name implies that barnyard.waldo needs to change every time there is
> > a reboot, making configurations unstable.
>
> That's normal behavior and has no ill effects.
>
> OK.  Does it mean I need to change the waldo config file each time my
> computer reboots or Snort restarts?

No.  Barnyard maintains the waldo file and understands that snort appends a 
numerical string to the end of its logfiles.

> > Can you tell me what I need to do from here to be able to automate Snort and
> > barnyard?
>
> Without knowing what OS you're using?  Not likely.
>
> SG: Red Hat EL 4

Google for it.  There are numerous documents out there that provide pre-written 
startup scripts for RedHat, but writing one yourself is trivial if you know any 
shell scripting at all.  Even if you don't, you can simply copy an existing 
script and change a few items.

Snort docs has numerous guides that include startup scripts. 
<http://www.snort.org/docs/>

And Patrick Harper's guides were excellent: 
<http://www.snort.org/docs/setup_guides/Snort_Base_Minimal.pdf>

-- 
Paul Schmehl (pauls () utdallas edu)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users