Re: Still Empty log file

[JJ Cummings <cummingsj () gmail com>]

Has the HUP or kill output been reviewed to verify good traffic (IE not any bad checksums, read checksum offloading, 
etc etc etc)

Sent from the iRoad

On Jul 20, 2012, at 16:55, "Lay, James" <james.lay () wincofoods com> wrote:

> Yonas,
>  
> Config looks good…could use tuning when you can.  For a test, put this into your local.rules file:
>  
> alert icmp any any -> any any (msg:"ICMP test"; classtype:bad-unknown; sid:10000016; rev:1;)
>  
> Then save and start up snort.  Ping to or from the machine you’re running snort on, and you should see alerts things 
> both in the u2 file, and snort.fast file.  Lemme know how it goes.
>  
> James
>  
> From: Yonas Abebe [mailto:jonasabebe () gmail com] 
> Sent: Friday, July 20, 2012 1:12 PM
> To: Lay, James
> Cc: snort-users () lists sourceforge net
> Subject: Re: [Snort-users] Still Empty log file
>  
> Hi james,
>  
> Here is my snort.conf. Thanks a lot.
> yonas
>  
>  
> On Fri, Jul 20, 2012 at 12:29 AM, Lay, James <james.lay () wincofoods com> wrote:
> Hi Yonas,
>  
> Can you put in your snort.conf here?  That will help.  Also, if say your HOME_NET is for example 192.168.1.0/24, and 
> you’re scanning/pinging from another IP on that same network, Snort won’t see it as it’s on the same LAN.
>  
> James
>  
> From: Yonas Abebe [mailto:jonasabebe () gmail com] 
> Sent: Thursday, July 19, 2012 2:35 PM
> To: Lay, James
> Cc: snort-users () lists sourceforge net
> Subject: Re: [Snort-users] Still Empty log file
>  
> Hi James,
>  
> I didn't put the whole path for the file name in the output lines of snort.conf (my mistake). Now, the output lines 
> look like the following:
>   
> output unified2: filename /var/log/snort/snort.u2, limit 128
> output alert_fast: /var/log/snort/snort.fast
>  
> Then i tried the same simple test using ping, tracert and nmap attack. Now the snort.fast, barnyard2.waldo and 
> snort.u2  contain some fixed size bytes which doesn't grow although i repeated the test attack many times. Is there 
> something that I am missing?
>  
> I really appreciate for the help.
>  
>  
>  
>
> On Wed, Jul 18, 2012 at 8:16 PM, Lay, James <james.lay () wincofoods com> wrote:
> From: Yonas Abebe [mailto:jonasabebe () gmail com]
> Sent: Monday, July 16, 2012 11:02 AM
> To: snort-users () lists sourceforge net
> Subject: [Snort-users] Still Empty log file
>
> Hi all,
>
> I am having problems with empty output log files. I am running Snort 2.9.2.2 on Ubuntu virtual machine by following 
> the guide at the Snort page. I have barnyard2 installed to send output to Mysql....unified2 output is configured on 
> snort.conf. I started snort with a command  
>
> sudo /usr/local/snort/bin/snort -u snort -g snort -c /usr/local/snort/etc/snort.conf  -i eth0 
>
> I started barnyard2 with the command
>
> sudo sudo /usr/local/bin/barnyard2 -c /usr/local/snort/etc/barnyard2.conf -d /var/log/snort -f snort.u2 -w 
> /var/log/snort/barnyard2.waldo
>
> The output of barnyard command is OK but shows, WARNING: Ignoring corrupt/truncated waldofile.
>
> For a simple test i did nmap attack,Snort creates the log files in /var/log/snort but the size is always empty. i can 
> see the output on the console though. I have tried to research and apply almost all the advice on similar issue in 
> this mailing list but none of them helped me. Could you please help me?
>
> thanks 
>
>
>
> Yonas,
>
> What are your output lines in your snort.conf?  Something like the below?
>
> output alert_fast: /var/log/snort.fast
> output unified2: filename /var/log/snort.u2
>
> If not, for testing, try adding the alert_fast to see what happens there.  Also, try the command u2spewfoo on your 
> snort.u2 file and see what that shows.
>
> James
>  
>  
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and 
> threat landscape has changed and how IT managers can respond. Discussions 
> will include endpoint security, mobile security and the latest in malware 
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!