[Snort-users] unified format

Igor Belikov ivb at ...13431...
Fri Aug 19 03:23:26 EDT 2005


Hello Roland,

Friday, August 19, 2005, 12:36:45 PM, you wrote:

>>  1. In archive of this mailing list I read that unified alert file
>>  contains only alerts information, and unified log file contains both
>>  alerts and corresponding payloads. But documentation says different:
>>  unified log contains only payload, and I confirmed this by some
>>  tests.


RTS> The unified log format does not contain broken out fields for
RTS> protocol-number or src/dest ip-address/port-number, while the unified
RTS> alert format does. This information is, however, still available in the
RTS> payload in the unified log format. The gen:sid:rev, classification,
RTS> priority, eventid and timestamps are presented identically in both formats
RTS> as part of the Event struct.

It's sounds good for me, but I can't correctly configure barnyard to
extract all needing info from unified log.

When I run barnyard to monitor unified log - no events stored in DB.
Please, anybody can help me to configure barnyard?

-- 
Best regards,
 Igor                            mailto:ivb at ...13431...





More information about the Snort-users mailing list