Re: Just upgraded snort - now barnyard won't run

[Paul Schmehl <pauls () utdallas edu>]

I just downgraded snort to 2.6.1.1, and this problem went away.  It appears 
there is something wrong with 2.6.1.2 that causes writes to the logs that 
barnyard doesn't like.

--On Tuesday, January 23, 2007 10:45:08 -0600 Paul Schmehl 
<pauls () utdallas edu> wrote:

> I just upgraded snort to version 2.6.1.2 (FreeBSD 6.1):
> snort -V
>
>    ,,_     -*> Snort! <*-
>   o"  )~   Version 2.6.1.2 (Build 34)  FreeBSD
>    ''''    By Martin Roesch & The Snort Team:
> http://www.snort.org/team.html
>            (C) Copyright 1998-2006 Sourcefire Inc., et al.
>
> Now barnyard won't start:
> tail /var/log/messages
> Jan 22 22:30:01 buttercup3 snort[56469]: Writing PID "56469" to file
> "/var/run//snort_bge0E.pid"
> Jan 22 22:30:01 buttercup3 snort[56469]: Daemon initialized, signaled
> parent pid: 56468
> Jan 22 22:30:01 buttercup3 snort[56468]: Daemon parent exiting
> Jan 22 22:31:06 buttercup3 snort[56469]: Snort initialization completed
> successfully (pid=56469)
> Jan 22 22:31:06 buttercup3 snort[56469]: Not Using PCAP_FRAMES
> Jan 23 16:08:43 buttercup3 barnyard[68251]: Initializing daemon mode
> Jan 23 16:08:43 buttercup3 barnyard[68252]: Opened spool file
> '/var/log/snort//snort.log.1169504455'
> Jan 23 16:08:43 buttercup3 barnyard[68252]: ERROR: Invalid packet length:
> 3810967040
> Jan 23 16:08:43 buttercup3 barnyard[68252]: FATAL ERROR: Read error
> Jan 23 16:08:43 buttercup3 barnyard[68252]: Exiting
>
> Snort.conf has:
> grep output /usr/local/etc/snort/snort.conf
> # Step #4: Configure output plugins
> # output alert_unified: filename snort.alert, limit 128
> output log_unified: filename snort.log, limit 128
>
> Was the spo_unified log format changed in some way?
>
> I've deleted a bunch of log files to get barnyard to start and stay
> running, but as soon as snort creates a new logfile, barnyard exits with
> a FATAL ERROR.
>
> Paul Schmehl (pauls () utdallas edu)
> Senior Information Security Analyst
> The University of Texas at Dallas
> http://www.utdallas.edu/ir/security/



Paul Schmehl (pauls () utdallas edu)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/

Attachment: _bin
Description:

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users