[Snort-users] barnyard to db
Andrew R. Baker
andrewb0x29a at ...131...
Thu Oct 4 09:15:02 EDT 2001
Barnyard is a generic output processing stage for snort. It has a modular
output plugin system that is similar (but not identical) to the one found
in snort. It reads data from the unified log/alert files (and actually
the stream4 binary output file) and calls the appropriate configured
output plugins to process the data. The goal is to seperate the core
detection engine from any output process that could impact packet capture
(like performing SQL inserts). It is valuable in both single system
sensors and distributed sensor enviroments. In a distributed enviroment,
each sensor would have an instance of barnyard processing the local data
and sending it to a central console.
--- Frank Reid <fcreid at ...691...> wrote:
> I'm confused on barnyard. From mailing list discussion and docs, I
> presume it rolls up the Snort binary output and performs the database
> insertions directly (rather than having Snort insert "real-time" into
> the database via the output preprocessor). Is that's correct, then is
> it of most value if Snort and the database live on the same box? In a
> distributed Snort sensor environment, one would have to "collect" the
> Snort output by some other means, then have barnyard read it into the
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> Snort-users list archive:
Do You Yahoo!?
NEW from Yahoo! GeoCities - quick and easy web site hosting, just $8.95/month.
More information about the Snort-users