[Snort-sigs] Unified2

Joel Esler jesler at ...435...
Tue Sep 18 13:03:42 EDT 2012


On Sep 18, 2012, at 12:03 PM, PR <oly562 at ...2420...> wrote:

> 1. does barnyard2 take what is in /var/log/snort/snort.unified2 and write that output that to mysql?
> 
Yes.  Among other capabilities, that's it's main use.


> 2. can snort.conf do logging to database with:
> 
> output database: alert, mysql, user=snort password=xxxxxx dbname=snort host=localhost
> output database: log, mysql, user=snort password=xxxxxx dbname=snort host=localhost

Not anymore.  We removed that in 2.9.3.0

> 
> instead of barnyard2.conf
> 
> 3. if so, should i turn off unified2 in snort.conf and only use
> 
> output database: alert, mysql, user=snort password=xxxxxx dbname=snort host=localhost
> output database: log, mysql, user=snort password=xxxxxx dbname=snort host=localhost

No. Even if you are using an older version of Snort, in order to insert into the DB, Snort has to stop what it's doing in other areas and input into the db.  While this may be very fast, an IDS should be an IDS.  Not a database insert tool.  The database output method was written as a college project back in the mid nineties, and shouldn't be used.

> 4. why is barnyard2 needed, and being promoted over oinkmaster or at all? pls explain. 

Apples and Oranges.  Barnyard2 manages output from Snort.  It takes the alerts from Snort and it outputs to the database.  (Or whatever other output function you choose).  Oinkmaster is a rule management tool, and has also been (at least I recommend) replaced by pulledpork, as the latter has a much greater feature set to be able to properly manage a Snort ruleset.

--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20120918/a761da0c/attachment.html>


More information about the Snort-sigs mailing list