[Snort-devel] [Snort-users] Need help in getting barnyard and Snort to work together

sudhakar govindavajhala sudhakarg79spam at ...2499...
Wed Jan 30 19:01:48 EST 2008

Thanks Paul,  please read on.

> 2) As I noticed, each time Snort is restarted, the log file name changes.
> For example, snort.log.1201695424 to snort.log.12016923232.  Why?  Change
> log file name implies that barnyard.waldo needs to change every time there
> a reboot, making configurations unstable.

That's normal behavior and has no ill effects.

OK.  Does it mean I need to change the waldo config file each time my
computer reboots or Snort restarts?

> Can you tell me what I need to do from here to be able to automate Snort
> barnyard?

Without knowing what OS you're using?  Not likely.

SG: Red Hat EL 4


BTW, if you read the source code for base, you'll discover that you can add
this to the barnyard.conf file and eliminate some of the long commandline
you start barnyard.

config class-file: /usr/local/etc/snort/classification.config
config sid-msg-map: /usr/local/etc/snort/sid-msg.map
config gen-msg-map: /usr/local/etc/snort/gen-msg.map

(Change the paths to fit your OS.)

So, having done that, you could start barnyard like this:
barnyard -D -c /etc/barnyard.conf -d /path-to/snort.log-directory -f
-w path-to/waldo.file

Barnyard will figure out which log file to open and keep track of where it's
in the waldo file.

Paul Schmehl (pauls at ...2957...)
Senior Information Security Analyst
The University of Texas at Dallas

This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20080130/7f9705db/attachment.html>

More information about the Snort-devel mailing list