[Snort-users] barnyard 2.0.0 & snort-2.8.1

Bamm Visscher bamm.visscher at ...11827...
Sat Apr 26 21:39:39 EDT 2008


It's not a "new" output format. If provided no output mechanism via
the cmd args or config, then snort uses binary (pcap) as the default
log type now. By default, snort also uses the prefix "snort.log" for
the binary output files. Yes, that is the same prefix as the unified
log output plugin uses. I wish someone would change that. Maybe
"snort.unified". Please?

Bammkkkk


On Sat, Apr 26, 2008 at 4:31 PM, Russell Fulton <r.fulton at ...3809...> wrote:
> Replying to myself ;)
>
>  Seconds after posting I had an inspiration and found that the output
>  line was missing in the config for this sensor so snort must have been
>  using the new output format.
>
>  What reads the new format?  Clearly barnyard does not...
>
>  Russell
>
>
>
>  On 27/04/2008, at 10:20 AM, Russell Fulton wrote:
>  > On just one of my sensors I am having problems with barnyard refusing
>  > to read snort log files:
>  >
>  > Apr 27 10:14:55 monitor-dmzi barnyard[12240]: Opened spool file '/
>  > home/
>  > snort/data/eth2//snort.log.1209245479'
>  > Apr 27 10:14:55 monitor-dmzi barnyard[12240]: FATAL ERROR: ERROR: No
>  > input plugin found for magic: a1b2c3d4
>  >
>  > So far as I can tell the set up is the same as of at least two other
>  > sensors which work fine.
>  >
>  > Any idea what is gong on?
>  >
>  > Russell
>  >
>  >
>  > -------------------------------------------------------------------------
>  > This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
>  > Don't miss this year's exciting event. There's still time to save
>  > $100.
>  > Use priority code J8TL2D2.
>  > http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
>  > _______________________________________________
>  > Snort-users mailing list
>  > Snort-users at lists.sourceforge.net
>  > Go to this URL to change user options or unsubscribe:
>  > https://lists.sourceforge.net/lists/listinfo/snort-users
>  > Snort-users list archive:
>  > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>  -------------------------------------------------------------------------
>  This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
>  Don't miss this year's exciting event. There's still time to save $100.
>  Use priority code J8TL2D2.
>  http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
>  _______________________________________________
>  Snort-users mailing list
>  Snort-users at lists.sourceforge.net
>  Go to this URL to change user options or unsubscribe:
>  https://lists.sourceforge.net/lists/listinfo/snort-users
>  Snort-users list archive:
>  http://www.geocrawler.com/redir-sf.php3?list=snort-users
>



-- 
sguil - The Analyst Console for NSM
http://sguil.sf.net




More information about the Snort-users mailing list