[Snort-users] Barnyard 0.2.0 (build 32) dumps core and wont compile with --enable-debug

[Russell Fulton]

My understanding is that barnyard is basically orphaned and
unmaintained.  I asked about 2.8 support a while back and was told that
there was no plans to update barnyard.

Russell

Andreas Maus wrote:
> Hi .*!
>
> So I sent this message to the barnyard-users mailinglist but
> it seems that this list is dead. :/
>
> Because this is (somehow) related to snort I will resent the message
> to this list ...
>
> I've tried to run barnyard 0.2.0 (build 32) to process the
> unified alert files generated by snort 2.8.0 but unfortunately
> it dumps core. e.g.:
>
> debian3164m:/var/log/snort#
> Barnyard Version 0.2.0 (Build 32)
> Segmentation fault (core dumped)
>
> This happens on:
>
> debian3164m:~# cat /etc/debian_version
> 4.0
> debian3164m:~# uname -a
> Linux debian3164m 2.6.8-12-amd64-k8-smp #1 SMP Thu Dec 7 18:44:52 UTC 2006 x86_64 GNU/Linux
>
> with snort:
>
> debian3164m:~# snort -V
>
>    ,,_     -*> Snort! <*-
>   o"  )~   Version 2.8.0 (Build 67) inline
>    ''''    By Martin Roesch & The Snort Team: http://www.snort.org/team.html
>            (C) Copyright 1998-2007 Sourcefire Inc., et al.
>            Using PCRE version: 6.7 04-Jul-2006
>
> Running barnyard in the dry-run mode it says:
>
> debian3164m:~# barnyard  -c /etc/snort/barnyard.conf  -d /var/log/snort -g /etc/snort/gen-msg.map -s /etc/snort/sid-msg.map -R -o snort.alert.1193349572
> Barnyard Version 0.2.0 (Build 32)
> Program Variables:
>   Batch processing mode
>   Config dir:    /etc/snort
>   Config file:   /etc/snort/barnyard.conf
>   Sid-msg file:  /etc/snort/sid-msg.map
>   Gen-msg file:  /etc/snort/gen-msg.map
>   Class file:    /etc/snort/classification.config
>   Hostname:      ypbind.de
>   Interface:     eth0
>   BPF Filter:
>   Log dir:       /root
>   Verbosity:     0
>   Localtime:     0
>   File list:
>     /var/log/snort/snort.alert.1193349572
> Output plugins enabled for 'alert' records
> -------------------------------------------------------
> OpAlertFast configured
>   Filename: fast.alert
> =======================================================
> Output plugins enabled for 'log' records
> -------------------------------------------------------
> OpLogDump configured
>   Filename: dump.log
> OpLogPcap configured
>   Filename: barnyard.pcap
> =======================================================
> Output plugins enabled for 'stream_stat' records
> -------------------------------------------------------
> None configured
> =======================================================
>
> So I tried to recompile with --enable-debug but this doesn't even compile:
>
> gcc -DHAVE_CONFIG_H -I. -I. -I../.. -I../.. -I../../src -I/usr/include/pcap    -g -O2 -Wall -DDEBUG -ggdb -c dp_stream_stat.c
> dp_stream_stat.c: In function 'StreamStatDpReadFileHeader':
> dp_stream_stat.c:104: warning: format '%d' expects type 'int', but argument 4 has type 'ssize_t'
> dp_stream_stat.c:104: warning: format '%d' expects type 'int', but argument 5 has type 'long unsigned int'
> dp_stream_stat.c:112: error: 'StreamStatFileHeader' has no member named 'magic'
> make[3]: *** [dp_stream_stat.o] Error 1
> make[3]: Leaving directory `/home/maus/tmp/barnyard-0.2.0/src/input-plugins'
> make[2]: *** [all-recursive] Error 1
> make[2]: Leaving directory `/home/maus/tmp/barnyard-0.2.0/src'
> make[1]: *** [all-recursive] Error 1
> make[1]: Leaving directory `/home/maus/tmp/barnyard-0.2.0'
> make: *** [all-recursive-am] Error 2
>
> It will compile if I comment the offending line in dp_stream_stat.c:112:
> 112: printf(" Magic          = 0x%X\n", file_header.magic);
>
> but does that help if I compile it like this and submit the backtrace of the
> generated core file ?
>
> Any help?
>
> So long,
>
> Andreas.
>
> P.S.: I attached my barnyard.conf to this message.
>
>   
> ------------------------------------------------------------------------
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems?  Stop.
> Now Search log events and configuration files using AJAX and a browser.
> Download your FREE copy of Splunk now >> http://get.splunk.com/
> ------------------------------------------------------------------------
>
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users