Re: barnyard2 not updating waldo file

["Daniel Qian" <daniel.qian () supracanada com>]

Hi Doug,

Thank you very much for the information. I installed Barnyard2-1.7Beta2 and
it looks much better now.

Best Regards,
Daniel

----- Original Message ----- 
From: "Burks, Doug" <doug.burks () morris com>
To: "Daniel Qian" <daniel.qian () supracanada com>; 
<snort-users () lists sourceforge net>
Sent: Tuesday, September 15, 2009 8:44 AM
Subject: RE: [Snort-users] barnyard2 not updating waldo file


Hi Daniel,

I had similar problems with Barnyard 2-1.6.  I worked with the
developers and they subsequently released Barnyard2-1.7Beta2, which
resolved the issue for me.  Please try it and see if it works for you:
http://www.securixlive.com/?p=176

If you continue to have problems with Barnyard2, please don't hesitate
to contact the developers, as they are very helpful and quite
responsive:
http://www.securixlive.com/about.php

Thanks,
Doug Burks

-----Original Message-----
From: Daniel Qian [mailto:daniel.qian () supracanada com]
Sent: Monday, September 14, 2009 11:46 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] barnyard2 not updating waldo file

Everything works for me except for the waldo file. When I start up
barnyard2, it creates the file by itself but when I stop barnyard2,
nothing happens. It always outputs from the same record if the waldo
file is still there when barnyard2 starts.
My machine is an intel 64bit running on Redhadhat Fedora 1l and running
Barnyard 2-1.6 on command line

/usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf  -d /var/log/snort
-f snort.log -w /var/log/snort/barnyard.waldo -D


settings in /etc/snort/barnyard2.conf:

config reference-map:   /etc/snort/reference.config
config class-map:           /etc/snort/classification.config
config gen-msg-map:     /etc/snort/gen-msg.map
config sid-msg-map:         /etc/snort/sid-msg.map
config hostname:        noc
config interface:       eth1
input unified2
output database: alert, mysql, user=snort password=snortpass
dbname=snort
host=localhost

Is anyone aware of this issue?


Thanks,
Daniel


------------------------------------------------------------------------
------
Come build with us! The BlackBerry&reg; Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and
stay
ahead of the curve. Join us from November 9&#45;12, 2009. Register
now&#33;
http://p.sf.net/sfu/devconf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users




------------------------------------------------------------------------------
Come build with us! The BlackBerry&reg; Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay 
ahead of the curve. Join us from November 9&#45;12, 2009. Register now&#33;
http://p.sf.net/sfu/devconf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users