Snort mailing list archives
Re: Where's Waldo?
From: AllowOverride <allowoverride () gmail com>
Date: Tue, 09 Oct 2012 12:08:11 -0700
here are my response:
Step 1: Get snort working
its working
Step 2: Setup a database for barnyard2 to write to
its working
Step 3: Setup barnyard2 and verify that it's reading snort logs
its working
Step 4: Verify that barnyard2 is writing to the database
its working
Step 5: Verify that base can login to the db and read the alerts
its working - but when i clear the data tables on base browser gui, no new data is being recorded. i noticed that if i restart the services, or restart apache2, it will start displaying again... kinda odd, i would have to restart anything,, wonders if base is really the right solution at this point, or, maybe there is a switch to flick in it,, i dont see it though, maybe in the base_config*'s. nothing yet, but i will keep looking. not much documentation for base, if you know of any, other than the READMES, let me know.
So - what are you logging with snort?
currently logging pings and anything that snort.rules finds
Are the logs there?
yep, see below
What format are they in? Does barnyard read that format?
unified2 format - snort.log.xxxxxx. not at first, but they are now.
All these pieces are independent of each other.
yes they are, agreed
Snort will happily log alerts all day long even if barnyard2 isn't installed.
yes it will, agreed
Barnyard2 will happily sit and wait forever to read a snort log that never shows up.
yes it will, agreed
Break the problem down into components.
i have been, staring with snort, then ufw, then pulledpork, then barnyard2, then base, then snortreport, then jpgraph, in that order.
Then verify each one before moving
yep, thats how i do it
to the next one. Is snort working? Yes
yes - but not as easily as howtos say it will for deb 12.04
, no. If yes, move on. If no, troubleshoot.
yep, thats what i did/do
Rinse, lather, repeat.
out of soap, got an extra bar? thanks. l8 ------------------------------------------------------------------------------ Don't let slow site performance ruin your business. Deploy New Relic APM Deploy New Relic app performance management and know exactly what is happening inside your Ruby, Python, PHP, Java, and .NET app Try New Relic at no cost today and get our sweet Data Nerd shirt too! http://p.sf.net/sfu/newrelic-dev2dev _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Where's Waldo? AllowOverride (Oct 08)
- Re: Where's Waldo? beenph (Oct 08)
- Re: Where's Waldo? AllowOverride (Oct 09)
- Re: Where's Waldo? Peter Bates (Oct 09)
- Re: Where's Waldo? waldo kitty (Oct 10)
- Re: Where's Waldo? AllowOverride (Oct 10)
- Re: Where's Waldo? AllowOverride (Oct 10)
- Re: Where's Waldo? AllowOverride (Oct 09)
- Re: Where's Waldo? AllowOverride (Oct 09)
- Re: Where's Waldo? Paul Schmehl (Oct 09)
- Re: Where's Waldo? AllowOverride (Oct 09)
- Re: Where's Waldo? Paul Schmehl (Oct 09)
- Re: Where's Waldo? AllowOverride (Oct 09)
- Re: Where's Waldo? Paul Schmehl (Oct 09)
- Re: Where's Waldo? AllowOverride (Oct 10)
- Re: Where's Waldo? waldo kitty (Oct 10)
- Re: Where's Waldo? AllowOverride (Oct 10)
- Re: Where's Waldo? waldo kitty (Oct 10)
- Re: Where's Waldo? AllowOverride (Oct 11)
- Re: Where's Waldo? Peter Bates (Oct 11)
- Re: Where's Waldo? Paul Schmehl (Oct 11)
- Re: Where's Waldo? beenph (Oct 08)