Snort mailing list archives
Barnyard2 startup issue
From: "Aycock, Jeff R." <JEFF.R.AYCOCK () saic com>
Date: Fri, 22 Jul 2011 08:06:17 -0400
Hello, I'm new to Snort and would appreciate any suggestion for an issue I am having with Barnyard2. I've installed Snort 2.9.0.5, Barnyard2 (1.10 beta 1) , and sguil-0.8.0 in a Fedora 15 box. Snort, snort_agent, and sguild all ran with no issues - I verified this using ps -ef|grep sguil: [root@10 firnsy-barnyard2-411db8a]ps -ef|grep sguil root 18246 22388 0 14:40 pts/4 00:00:00 tclsh ./sguild root 18251 18246 0 14:40 pts/4 00:00:00 tclsh ./sguild root 18252 18246 0 14:40 pts/4 00:00:00 tclsh ./sguild root 18354 18332 0 15:14 pts/5 00:00:00 grep --color=auto sguil sguil 22705 22438 0 08:55 pts/6 00:00:12 snort -u sguil -g sguil -c /etc/snort/snort.conf -i eth0 -U -A none -m 122 -l /var/log/snort_data/sensor root 22772 1 0 09:11 ? 00:00:06 tclsh /opt/sguil-0.8.0/sensor/snort_agent.tcl -c /opt/sguil-0.8.0/sensor/snort_agent.conf I verified that the correct ports are used: [root@10 firnsy-barnyard2-411db8a]# lsof -i :7736 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME tclsh 18246 root 14u IPv4 4665775 0t0 TCP *:7736 (LISTEN) [root@10 firnsy-barnyard2-411db8a]# lsof -i :7735 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME tclsh 22772 root 4u IPv4 4442250 0t0 TCP XXXXXXXXXX:7735 (LISTEN) When I attempt to start Barnyard2: [root@10 firnsy-barnyard2-411db8a]# /usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf -d /snort_data/sensor -f snort.log -w /etc/snort/waldo.file -G /etc/snort/gen-msg.map -S /etc/snort/sid-msg.map -v I get this error message: Running in Continuous mode --== Initializing Barnyard2 ==-- Initializing Input Plugins! Initializing Output Plugins! Parsing config file "/etc/snort/barnyard2.conf" ............ ........... sguil: Connected to localhost on 7735. ERROR: Connecton closed by client sguil: Connected to localhost on 7735. ERROR: Connecton closed by client sguil: Connected to localhost on 7735. ERROR: Connecton closed by client ............. ............ It didn't matter whether I ran as another user or root, the results are the same. Does anyone have any suggestion or encounter the same issue? Thanks in advance! Jeff
------------------------------------------------------------------------------ 10 Tips for Better Web Security Learn 10 ways to better secure your business today. Topics covered include: Web security, SSL, hacker attacks & Denial of Service (DoS), private keys, security Microsoft Exchange, secure Instant Messaging, and much more. http://www.accelacomm.com/jaw/sfnl/114/51426210/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please see http://www.snort.org/docs for documentation
Current thread:
- Barnyard2 startup issue Aycock, Jeff R. (Jul 22)
- Re: Barnyard2 startup issue James Lay (Jul 22)
- Re: Barnyard2 startup issue Aycock, Jeff R. (Jul 22)
- Re: Barnyard2 startup issue Lay, James (Jul 22)
- Re: Barnyard2 startup issue beenph (Jul 22)
- Re: Barnyard2 startup issue Aycock, Jeff R. (Jul 22)
- Re: Barnyard2 startup issue James Lay (Jul 22)