[Snort-users] "No input plugin found for magic: a1b2c3d4" Issue

Rachmat Hidayat Al-Anshar rachmat_hidayat_02 at ...131...
Tue May 6 17:06:55 EDT 2008

I try to installing snort- on OpenBSD-4.2, before that, I try to patching it with snortsam's patch diff file (snortsam- There is nothing to problem at all when I have to compiling and installing Snort. But I got this following error when issuing "make" to installing Barnyard:

ProgVars.c: In function `ProgVars_Fprintf':
ProgVars.c:672: warning: long unsigned int format, time_t arg (arg 3)
gcc  -g -O2 -Wall -L/usr/local/lib/mysql/ -o barnyard  barnyard.o mstring.o strlcatu.o strlcpyu.o util.o  spool.o sid.o debug.o classification.o CommandLineArgs.o ConfigFile.o  ProgVars.o output-plugins/libop.a input-plugins/libdp.a -lz -lssl -lmysqlclient
/usr/local/lib/mysql//libmysqlclient.so.18.0: warning: strcpy() is almost always misused, please use strlcpy()
output-plugins/libop.a(op_sguil.o)(.text+0xea): In function `OpSguil_Start':
/etc/barnyard/src/output-plugins/op_sguil.c:220: warning: sprintf() is often misused, please use snprintf()
output-plugins/libop.a(op_sguil.o)(.text+0x4da): In function `OpSguil_Log':
/etc/barnyard/src/output-plugins/op_sguil.c:366: warning: strcat() is almost always misused, please use strlcat()

I try to continue the process with hope there is nothing wrong with barnyard processing the snort's unified file.
But lately I know that I was wrong...

Barnyard produce this messages 

# tail /var/log/messages
May  7 09:01:00 snort barnyard: No bookmark file found, processing all events
May  7 09:01:03 snort barnyard[10430]: Initializing daemon mode
May  7 09:01:03 snort barnyard[23654]: Opened spool file '/var/log/snort//snort.log.1210120583'
May  7 09:01:03 snort barnyard[23654]: FATAL ERROR: ERROR: No input plugin found for magic: a1b2c3d4
May  7 09:01:03 snort barnyard[23654]: Exiting

when I try to running it with:
# /usr/local/bin/barnyard \
-c /etc/snort/barnyard.conf \
-d /var/log/snort/ \
-L /var/log/snort/ \
-s /etc/snort/sid-msg.map \
-g /etc/snort/gen-msg.map \
-p /etc/snort/classification.config \
-a /var/log/snort/archive/ \
-f snort.log \
-w /var/log/snort/barnyard.waldo \
-X /var/run/barnyard.pid \

Now, what should I do?

Thanks in advance

Be a better friend, newshound, and know-it-all with Yahoo! Mobile.  Try it now.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20080506/b9d4c371/attachment.html>

More information about the Snort-users mailing list