[Snort-users] unified format
ivb at ...13431...
Fri Aug 19 03:23:26 EDT 2005
Friday, August 19, 2005, 12:36:45 PM, you wrote:
>> 1. In archive of this mailing list I read that unified alert file
>> contains only alerts information, and unified log file contains both
>> alerts and corresponding payloads. But documentation says different:
>> unified log contains only payload, and I confirmed this by some
RTS> The unified log format does not contain broken out fields for
RTS> protocol-number or src/dest ip-address/port-number, while the unified
RTS> alert format does. This information is, however, still available in the
RTS> payload in the unified log format. The gen:sid:rev, classification,
RTS> priority, eventid and timestamps are presented identically in both formats
RTS> as part of the Event struct.
It's sounds good for me, but I can't correctly configure barnyard to
extract all needing info from unified log.
When I run barnyard to monitor unified log - no events stored in DB.
Please, anybody can help me to configure barnyard?
Igor mailto:ivb at ...13431...
More information about the Snort-users