Response 1: Barnyard trouble acid_db

["Jacob, Raymond A Jr" <raymond.jacob () navy mil>]

I believe I downloaded the packages from
ftp.bsd.org/pub/FreeBSD/ports/i386/packages-6.0-release/All/barnyard-0.2.0.tbz  48303 Oct 12 13:36
and
ftp.bsd.org/pub/FreeBSD/ports/i386/packages-6-stable/All/barnyard-0.2.0.tbz     48329 Feb 12 11:43

I tried both packages and they could not find the acid_db plugin.

Next I took your suggestion and cd to /usr/ports/security/barnyard/
and ran make install.

ports kept trying to fetch mysq-client-4.13.tar.gz from alot of strange places.

I am thinking because I have not run cvsup yet  that
the ports tree is out of date. I can not run cvsup until after hours and I forgot
to run it last night.
Next:
I downloaded the package:
 ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-6.0-release/databases/mysql-client-4.1.13.tbz

then ran pkg_add -f mysql-client-4.1.13.tbz. I had already installed mysql-client-4.1.16_1 to get
snort to send alerts to the mysql database before I decided to try barnyard.
so I had to force the install of mysql-client-4.1.13.tbz.

I don't know why barnyard requires mysql-client-4.1.13 and did not use mysql-client-4.1.16_1 in /var/db.
I typed: cd /usr/ports/security/barnyard,ran make, make install, and clean.
I ran barnyard.I did not get mysql errors anymore that I had with version that I downloaded from 
www.snort.org/dl/barnyard and barnyard is attempting to contact the mysql database.

A few questions if I may:
Question1: It is my understanding one can have more than one instance of barnyard running.
Does each barnyard require its own unifed log/alert file or can multiple barnyard processes
share the same output file?
Question2: How do I turn the /doc/USAGE file into a man page?
Question3: Where is the MASTER_SITE info kept for mysql? I would like to speed up install
when I do this on another box instead of typing 
make MASTER_SITE_OVERIDE =ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-6.0-release/databases/
in the /usr/ports/database/mysql41-client directory.

Thank you,
Raymond
--------------------------------------------------
List:       snort-users
Subject:    Re: [Snort-users] Barnyard trouble acid_db
From:       Paul Schmehl <pauls () utdallas ! edu>
Date:       2006-02-22 23:40:09
Message-ID: C5608885AA843C8F0D6F81F7 () utd59514 ! utdallas ! edu
[Download message RAW]

Did you try building barnyard from ports?  That should work fine.  (I'm the 
port maintaner.)  I'm not sure why the package failed.  the acid_alert_db 
plugin is compiled in by default.  Where did you download the package from?

If you want to build from source, you'll have to edit configure.in to get 
barnyard to compile correctly on FreeBSD.

Look at the patch file in /usr/ports/security/barnyard/files/.

--On Wednesday, February 22, 2006 18:24:47 -0500 "Jacob, Raymond A Jr" 
<raymond.jacob () navy mil> wrote:

> O/S FreeBSD 6.0
> snort: 2.4.3 Build 26 Freebsd.
> Barnyard: 0.2.0
>
> snort seems to work.
> I am generating snort.log.* and snort.alert.* files.
> I downloaded barnyard-0.2.0 the freebsd package, installed it,  and
> when I ran barnyard got the error acid_alert_db plugin not found.
> So the acid output plugin was not built with barnyard in the package.
> I download barnyard-0.2.0 from www.snort.org and try to compile
> barnyard on my own.
> sh configure --enable-mysql --with-mysql-libraries=/usr/local/lib/mysql
> make
> make install
>
> when I try to start  barnyard now I get the error
> /libexec/ld-elf.so.1: Shared object "libmysqlclient.so.14" not found
> required by " barnyard"
>
> any suggestions on what I am doing wrong?
>
> Thank you,
> Raymond


-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid0944&bid$1720&dat1642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users