[Snort-users] [Snort-devel] [Sguil-users] Barnyard stop suddenly

Eric Lauzon eric.lauzon at ...13827...
Tue Oct 10 11:16:47 EDT 2006


Hi,
We have seen this problem before
and there is a way to stop this from happening,
generaly the spo_unified module will do multiple fwrite to 
the unified file [dataHeader,eventHeader,Payload], thus it is possible to interupt snort betwen 
one of those fwrite call, thus corrupting the unified file, 
the work arround is to use a static allocated buffer and to write it in a single block.

I have a patched version of spo_unified for 2.4.x series
and 2.6.X series

i might submit them again if needed.

-elz
 

> -----Original Message-----
> From: snort-devel-bounces at lists.sourceforge.net 
> [mailto:snort-devel-bounces at lists.sourceforge.net] On Behalf 
> Of Bamm Visscher
> Sent: Tuesday, October 10, 2006 11:12 AM
> To: sguil-users at lists.sourceforge.net
> Cc: Snort; snort-devel at lists.sourceforge.net
> Subject: Re: [Snort-devel] [Sguil-users] Barnyard stop suddenly
> 
> This is a snort unified output problem that creeps up every 
> couple of months. I am not sure there has ever been a fix for 
> it.  What version of snort are you running?
> 
> Bammkkkk
> 
> 
> On 10/10/06, Jesús Gálvez <jesuxgalvez at ...11031...> wrote:
> > Hi, I hace installed snort+sguil+barnyard. My problem is that when 
> > some time pass (usually one day), barnyard is down, and  I only got 
> > raise it erasing waldo.file and restarting the service barnyard.
> >
> > If I try raise the service without erase waldo.dile the 
> syslog give me 
> > the next error:
> >
> > ERROR: Invalid packet length: 171390775 Oct  9 11:42:54 localhost 
> > barnyard[19280]: FATAL ERROR: Read error Oct  9 11:42:54 localhost 
> > barnyard[19280]: Exiting
> >
> >
> > I don´t know where can be the problem.
> >
> >
> >  ________________________________
> >
> > LLama Gratis a cualquier PC del Mundo.
> > Llamadas a fijos y móviles desde 1 céntimo por minuto.
> > http://es.voice.yahoo.com
> >
> >
> > 
> ----------------------------------------------------------------------
> > --- Take Surveys. Earn Cash. Influence the Future of IT Join 
> > SourceForge.net's Techsay panel and you'll get the chance to share 
> > your opinions on IT & business topics through brief surveys -- and 
> > earn cash 
> > 
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEV
> > DEV
> >
> > _______________________________________________
> > Sguil-users mailing list
> > Sguil-users at lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/sguil-users
> >
> >
> >
> 
> 
> --
> sguil - The Analyst Console for NSM
> http://sguil.sf.net
> 
> --------------------------------------------------------------
> -----------
> Take Surveys. Earn Cash. Influence the Future of IT Join 
> SourceForge.net's Techsay panel and you'll get the chance to 
> share your opinions on IT & business topics through brief 
> surveys -- and earn cash 
> http://www.techsay.com/default.php?page=join.php&p=sourceforge
> &CID=DEVDEV
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
>

AVERTISSEMENT CONCERNANT LA CONFIDENTIALITÉ 

Le présent message est à l'usage exclusif du ou des destinataires mentionnés ci-dessus. Son contenu est confidentiel et peut être assujetti au secret professionnel. Si vous avez reçu le présent message par erreur, veuillez nous en aviser immédiatement et le détruire en vous abstenant d'en faire une copie, d'en divulguer le contenu ou d'y donner suite.

CONFIDENTIALITY NOTICE

This communication is intended for the exclusive use of the addressee identified above. Its content is confidential and may contain privileged information. If you have received this communication by error, please notify the sender and delete the message without copying or disclosing it.




More information about the Snort-users mailing list