Snort mailing list archives
multiple instances of snort and barnyard
From: "Spencer Anderson" <sanderson () clearnorthtech com>
Date: Wed, 23 Aug 2006 09:41:05 -0500
I run several instances of Snort on SuSE Linux (to monitor traffic on 2-3 NICs) and I have been logging directly to a MySQL database. I would like to start using the unified output and barnyard. I have it working for the most part, the problem is I have a unified output file for each interface that I have snort listening on and I can't get multiple instances of barnyard to run in continuous mode to process each log file. I'd prefer to run barnyard in batch mode in 10 minute intervals on each log file, I can't seem to do that either without restarting snort each time after I run barnyard to create a new unified log file. Is there a way to run barnyard in batch mode so that each time it's run against a file it only processes events that it hasn't processed before? Or, is there a way to have multiple continuous instances of barnyard running so each instance can maintain its corresponding snort unified log file? Or, is there a better way to have each event captured by snort associated with the network interface it was detected on? SuSE Enterprise 9 Snort 2.4.5 Barnyard 0.2.0 Thanks, Spencer ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- multiple instances of snort and barnyard Spencer Anderson (Aug 23)
- Re: multiple instances of snort and barnyard Joel Esler (Aug 23)
- Re: multiple instances of snort and barnyard Paul Schmehl (Aug 23)
- <Possible follow-ups>
- Re: multiple instances of snort and barnyard Spencer Anderson (Aug 23)