Re: Still Empty log file

["Lay, James" <james.lay () wincofoods com>]

From: Yonas Abebe [mailto:jonasabebe () gmail com] 
Sent: Monday, July 16, 2012 11:02 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] Still Empty log file

Hi all,

I am having problems with empty output log files. I am running Snort 2.9.2.2 on Ubuntu virtual machine by following the 
guide at the Snort page. I have barnyard2 installed to send output to Mysql....unified2 output is configured on 
snort.conf. I started snort with a command  

sudo /usr/local/snort/bin/snort -u snort -g snort -c /usr/local/snort/etc/snort.conf  -i eth0 

I started barnyard2 with the command

sudo sudo /usr/local/bin/barnyard2 -c /usr/local/snort/etc/barnyard2.conf -d /var/log/snort -f snort.u2 -w 
/var/log/snort/barnyard2.waldo

The output of barnyard command is OK but shows, WARNING: Ignoring corrupt/truncated waldofile.

For a simple test i did nmap attack,Snort creates the log files in /var/log/snort but the size is always empty. i can 
see the output on the console though. I have tried to research and apply almost all the advice on similar issue in this 
mailing list but none of them helped me. Could you please help me?

thanks 




Yonas,

What are your output lines in your snort.conf?  Something like the below?

output alert_fast: /var/log/snort.fast
output unified2: filename /var/log/snort.u2

If not, for testing, try adding the alert_fast to see what happens there.  Also, try the command u2spewfoo on your 
snort.u2 file and see what that shows.

James

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!