[Snort-users] Just upgraded snort - now barnyard won't run

Paul Schmehl pauls at ...6838...
Tue Jan 23 11:45:08 EST 2007


I just upgraded snort to version 2.6.1.2 (FreeBSD 6.1):
snort -V

   ,,_     -*> Snort! <*-
  o"  )~   Version 2.6.1.2 (Build 34)  FreeBSD
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/team.html
           (C) Copyright 1998-2006 Sourcefire Inc., et al.

Now barnyard won't start:
tail /var/log/messages
Jan 22 22:30:01 buttercup3 snort[56469]: Writing PID "56469" to file 
"/var/run//snort_bge0E.pid"
Jan 22 22:30:01 buttercup3 snort[56469]: Daemon initialized, signaled 
parent pid: 56468
Jan 22 22:30:01 buttercup3 snort[56468]: Daemon parent exiting
Jan 22 22:31:06 buttercup3 snort[56469]: Snort initialization completed 
successfully (pid=56469)
Jan 22 22:31:06 buttercup3 snort[56469]: Not Using PCAP_FRAMES
Jan 23 16:08:43 buttercup3 barnyard[68251]: Initializing daemon mode
Jan 23 16:08:43 buttercup3 barnyard[68252]: Opened spool file 
'/var/log/snort//snort.log.1169504455'
Jan 23 16:08:43 buttercup3 barnyard[68252]: ERROR: Invalid packet length: 
3810967040
Jan 23 16:08:43 buttercup3 barnyard[68252]: FATAL ERROR: Read error
Jan 23 16:08:43 buttercup3 barnyard[68252]: Exiting

Snort.conf has:
grep output /usr/local/etc/snort/snort.conf
# Step #4: Configure output plugins
# output alert_unified: filename snort.alert, limit 128
output log_unified: filename snort.log, limit 128

Was the spo_unified log format changed in some way?

I've deleted a bunch of log files to get barnyard to start and stay 
running, but as soon as snort creates a new logfile, barnyard exits with a 
FATAL ERROR.

Paul Schmehl (pauls at ...6838...)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pkcs7-signature
Size: 4085 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20070123/06e00874/attachment.bin>


More information about the Snort-users mailing list