[Snort-users] Just upgraded snort - now barnyard won't run

Paul Schmehl pauls at ...6838...
Tue Jan 23 16:25:02 EST 2007


I just downgraded snort to 2.6.1.1, and this problem went away.  It appears 
there is something wrong with 2.6.1.2 that causes writes to the logs that 
barnyard doesn't like.

--On Tuesday, January 23, 2007 10:45:08 -0600 Paul Schmehl 
<pauls at ...6838...> wrote:

> I just upgraded snort to version 2.6.1.2 (FreeBSD 6.1):
> snort -V
>
>    ,,_     -*> Snort! <*-
>   o"  )~   Version 2.6.1.2 (Build 34)  FreeBSD
>    ''''    By Martin Roesch & The Snort Team:
> http://www.snort.org/team.html
>            (C) Copyright 1998-2006 Sourcefire Inc., et al.
>
> Now barnyard won't start:
> tail /var/log/messages
> Jan 22 22:30:01 buttercup3 snort[56469]: Writing PID "56469" to file
> "/var/run//snort_bge0E.pid"
> Jan 22 22:30:01 buttercup3 snort[56469]: Daemon initialized, signaled
> parent pid: 56468
> Jan 22 22:30:01 buttercup3 snort[56468]: Daemon parent exiting
> Jan 22 22:31:06 buttercup3 snort[56469]: Snort initialization completed
> successfully (pid=56469)
> Jan 22 22:31:06 buttercup3 snort[56469]: Not Using PCAP_FRAMES
> Jan 23 16:08:43 buttercup3 barnyard[68251]: Initializing daemon mode
> Jan 23 16:08:43 buttercup3 barnyard[68252]: Opened spool file
> '/var/log/snort//snort.log.1169504455'
> Jan 23 16:08:43 buttercup3 barnyard[68252]: ERROR: Invalid packet length:
> 3810967040
> Jan 23 16:08:43 buttercup3 barnyard[68252]: FATAL ERROR: Read error
> Jan 23 16:08:43 buttercup3 barnyard[68252]: Exiting
>
> Snort.conf has:
> grep output /usr/local/etc/snort/snort.conf
># Step #4: Configure output plugins
># output alert_unified: filename snort.alert, limit 128
> output log_unified: filename snort.log, limit 128
>
> Was the spo_unified log format changed in some way?
>
> I've deleted a bunch of log files to get barnyard to start and stay
> running, but as soon as snort creates a new logfile, barnyard exits with
> a FATAL ERROR.
>
> Paul Schmehl (pauls at ...6838...)
> Senior Information Security Analyst
> The University of Texas at Dallas
> http://www.utdallas.edu/ir/security/



Paul Schmehl (pauls at ...6838...)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pkcs7-signature
Size: 4085 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20070123/7c5ab3ca/attachment.bin>


More information about the Snort-users mailing list