[Snort-users] Snort, Barnyard, webmin issues
kjsmith at ...13166...
Fri Dec 2 10:51:02 EST 2005
I know this problem is something to do with webmin, but I figured
someone here may have seen this error before.
I'm setting up snort (Version 2.4.3 (Build 26)) with barnyard (Version
0.2.0 (Build 32)) and logging to a mysql database on a Fedora Core 4
system. Snort is configured to log to tcpdump logs that barnyard will
read into the DB.
When I run the commands below (without -D of course), everything works
fine. Even with the -D so of course there is no error shown. Now, in
webmin under the snort module, I have the same command for snort under
"full path to snort executable (with options)" under the module
configuration as I do below for snort. Snort starts without any problems
but it doesn't generate tcpdump logs, and when I start barnyard, which I
do manually, I get this error if I take the -D option off.
Barnyard Version 0.2.0 (Build 32)
Opened spool file '/var/log/snort/snort.log.1133542635'
ERROR: No input plugin found for magic: a1b2c3d4
Fatal Error, Quitting..
My question is, is there a reason why the command from the prompt will
start logging correctly but from webmin the same command will not? Has
anyone seen this error before? I know it is because the tcpdump log
files are not being generated, but I can't seem to figure out why it is
not generating the files. Any ideas or suggestions would be great.
Here are the commands and configuration settings.
Here is the output config from snort:
output log_tcpdump: tcpdump.log
output log_unified: filename /var/log/snort/snort.log, limit 128
Command for barnyard to start:
barnyard -c /usr/src/barnyard-0.2.0/etc/barnyard.conf -d /var/log/snort
-a /var/log/snort-archive -f snort.log -w /var/log/snort/waldo
-s /etc/snort/sid-msg.map -g /etc/snort/gen-msg.map -p
Command to start snort:
/usr/sbin/snort -u snort -g snort -d -C -c /etc/snort/snort.conf -A fast -D
More information about the Snort-users