Re: Q: Barnyard on multiple interfaces

["Andrew R. Baker" <andrewb () snort org>]

Gordon Cunningham wrote:
> I'm having problems with running snort on 3-4 interfaces on the same machine
> (separate invocations, conf and log files - one for each interface), and
> running barnyard to pick up the logs and insert them into a remote ACID
> MySQL database (again, separate invocation and conf files - one for each
> interface).  The main problem I'm seeing is either the db inserts don't work
> at all, or all implementations of barnyard input the same info into all
> sensor ID's (the primary snort interface).

You probably need to adjust your Barnyard configuration files to either 
properly specify the interface name or the sensor id you want events 
inserted as in the database.

Specifying the sensor id directly is easiest, you just change the value 
for the sensor_id argument in the XXX_acid_db output plugin.  Each 
interface you run Snort on will need to have its own sensor id.

If you want to be fancier, you can remove the sensor_id option 
completely from the XXX_acid_db output plugin and instead set the 
interface and hostname config variables.  Doing this will cause Barnyard 
to query the database for the appropriate sensor id and create a new one 
if necessary.  Setting these values would be done with the following 
lines in the Barnyard configuration file:

config interface: eth0
config hostname: snorthost


I recommend the 2nd choice, since that matches more closely to what 
Snort does.  You can also specify the BPF filter used for the sensor 
instance if you want with:

config filter: not port 22


Let me know if either of the above methods does not fix the problem you 
are seeing.

-A



-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users