Snort mailing list archives

Previous By Date Next
Previous By Thread Next

Re: Still Empty log file

From: Yonas Abebe <jonasabebe () gmail com>
Date: Sun, 22 Jul 2012 11:10:23 +0300
I started barnyard2 with the following command after starting snort.

sudo /usr/local/barnyard2 -c /usr/local/snort/etc/barnyard2.conf -d
/var/log/snort/ -f snort.u2 -w /var/log/snort -G
/usr/local/snort/etc/gen-msg.map -S  /usr/local/snort/etc/sid-msg.map

The output of the command is the following.

 --== Initializing Barnyard2 ==--
Initializing Input Plugins!
Initializing Output Plugins!
Parsing config file "/usr/local/snort/etc/barnyard2.conf"
Log directory = /var/log/barnyard2
database: inconsistent cid information for sid=2
          Recovering by rolling forward the cid=102
database: compiled support for (mysql)
database: configured to use mysql
database: schema version = 107
database:           host = localhost
database:           user = snort
database:  database name = snort
database:    sensor name = localhost:eth0
database:      sensor id = 2
database:     sensor cid = 103
database:  data encoding = hex
database:   detail level = full
database:     ignore_bpf = no
database: using the "log" facility

        --== Initialization Complete ==--

  ______   -*> Barnyard2 <*-
 / ,,_  \  Version 2.1.9 (Build 263)
 |o"  )~|  By the SecurixLive.com Team: http://www.securixlive.com/about.php
 + '''' +  (C) Copyright 2008-2010 SecurixLive.

           Snort by Martin Roesch & The Snort Team:
http://www.snort.org/team.html
           (C) Copyright 1998-2007 Sourcefire Inc., et al.

Using waldo file '/var/log/snort/barnyard2.waldo':
    spool directory = /var/log/snort
    spool filebase  = snort.u2
    time_stamp      = 1342943239
    record_idx      = 6
Opened spool file '/var/log/snort/snort.u2.1342943239'
Closing spool file '/var/log/snort/snort.u2.1342943239'. Read 6 records
Opened spool file '/var/log/snort/snort.u2.1342943594'
Waiting for new data


Thanks






On Sun, Jul 22, 2012 at 2:13 AM, Jeremy Hoel <jthoel () gmail com> wrote:


When you start barnyard2 do you get any errors?  Does it complain about
not seeing the DB or tables?
On Jul 21, 2012 9:20 AM, "Yonas Abebe" <jonasabebe () gmail com> wrote:


Hi James,

It works now. I can see the alerts in the snort.fast file. The u2 file
also has contents although i couldn't see it. I was also trying to see
whether barnyard2 has sent the alerts to mysql. I used "show tables" in
mysql but couldn't see anything.

Thanks again James

On Sat, Jul 21, 2012 at 1:55 AM, Lay, James <james.lay () wincofoods com>wrote:


Yonas,****

** **

Config looks good…could use tuning when you can.  For a test, put this
into your local.rules file:****

** **

alert icmp any any -> any any (msg:"ICMP test"; classtype:bad-unknown;
sid:10000016; rev:1;)****

** **

Then save and start up snort.  Ping to or from the machine you’re
running snort on, and you should see alerts things both in the u2 file, and
snort.fast file.  Lemme know how it goes.****

** **

James****

** **

*From:* Yonas Abebe [mailto:jonasabebe () gmail com]
*Sent:* Friday, July 20, 2012 1:12 PM

*To:* Lay, James
*Cc:* snort-users () lists sourceforge net
*Subject:* Re: [Snort-users] Still Empty log file****

** **

Hi james,****

** **

Here is my snort.conf. Thanks a lot.****

yonas****

** **

** **

On Fri, Jul 20, 2012 at 12:29 AM, Lay, James <james.lay () wincofoods com>
wrote:****

Hi Yonas,****

 ****

Can you put in your snort.conf here?  That will help.  Also, if say your
HOME_NET is for example 192.168.1.0/24, and you’re scanning/pinging
from another IP on that same network, Snort won’t see it as it’s on the
same LAN.****

 ****

James****

 ****

*From:* Yonas Abebe [mailto:jonasabebe () gmail com]
*Sent:* Thursday, July 19, 2012 2:35 PM
*To:* Lay, James
*Cc:* snort-users () lists sourceforge net
*Subject:* Re: [Snort-users] Still Empty log file****

 ****

Hi James,****

 ****

I didn't put the whole path for the file name in the output lines of
snort.conf (my mistake). Now, the output lines look like the following:*
***

  ****

output unified2: filename /var/log/snort/snort.u2, limit 128****

output alert_fast: /var/log/snort/snort.fast****

 ****

Then i tried the same simple test using ping, tracert and nmap attack.
Now the snort.fast, barnyard2.waldo and snort.u2  contain some fixed size
bytes which doesn't grow although i repeated the test attack many times. Is
there something that I am missing?****

 ****

I really appreciate for the help.****

 ****

 ****

 ****

On Wed, Jul 18, 2012 at 8:16 PM, Lay, James <james.lay () wincofoods com>
wrote:****

From: Yonas Abebe [mailto:jonasabebe () gmail com]
Sent: Monday, July 16, 2012 11:02 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] Still Empty log file****


Hi all,

I am having problems with empty output log files. I am running Snort
2.9.2.2 on Ubuntu virtual machine by following the guide at the Snort page.
I have barnyard2 installed to send output to Mysql....unified2 output is
configured on snort.conf. I started snort with a command

sudo /usr/local/snort/bin/snort -u snort -g snort -c
/usr/local/snort/etc/snort.conf  -i eth0

I started barnyard2 with the command

sudo sudo /usr/local/bin/barnyard2 -c
/usr/local/snort/etc/barnyard2.conf -d /var/log/snort -f snort.u2 -w
/var/log/snort/barnyard2.waldo

The output of barnyard command is OK but shows, WARNING: Ignoring
corrupt/truncated waldofile.

For a simple test i did nmap attack,Snort creates the log files in
/var/log/snort but the size is always empty. i can see the output on the
console though. I have tried to research and apply almost all the advice on
similar issue in this mailing list but none of them helped me. Could you
please help me?

thanks


****

Yonas,

What are your output lines in your snort.conf?  Something like the below?

output alert_fast: /var/log/snort.fast
output unified2: filename /var/log/snort.u2

If not, for testing, try adding the alert_fast to see what happens
there.  Also, try the command u2spewfoo on your snort.u2 file and see what
that shows.

James****

 ****

** **





------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest
Snort news!




------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!
Previous By Date Next
Previous By Thread Next

Current thread: