Snort mailing list archives
Re: multiple instances of snort and barnyard
From: Paul Schmehl <pauls () utdallas edu>
Date: Wed, 23 Aug 2006 13:02:14 -0500
--On Wednesday, August 23, 2006 09:41:05 -0500 Spencer Anderson <sanderson () clearnorthtech com> wrote:
Barnyard does this by default, but you can specify a waldo file if you like.Is there a way to run barnyard in batch mode so that each time it's run against a file it only processes events that it hasn't processed before?
Sure. I run three on one box. Just create symlinks to the binary - barnyard1, barnyard2 and barnyard3. Then create duplicate startup scripts with the right switches for each instance, etc. The pidfiles should be named after each instance so one doesn't negate another.Or, is there a way to have multiple continuous instances of barnyard running so each instance can maintain its corresponding snort unified log file?
Start three instances of snort, each with its own interface specified. Make sure you use the -R switch to append a character to the pid file for each instance and specify the location of each logfile, etc., etc.Or, is there a better way to have each event captured by snort associated with the network interface it was detected on?
It's all very doable (I've been doing it for some time now). You just have to think through how to separate the processes and their results so they don't "step on" each other.
Paul Schmehl (pauls () utdallas edu) Adjunct Information Security Officer The University of Texas at Dallas http://www.utdallas.edu/ir/security/
Attachment:
_bin
Description:
------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- multiple instances of snort and barnyard Spencer Anderson (Aug 23)
- Re: multiple instances of snort and barnyard Joel Esler (Aug 23)
- Re: multiple instances of snort and barnyard Paul Schmehl (Aug 23)
- <Possible follow-ups>
- Re: multiple instances of snort and barnyard Spencer Anderson (Aug 23)