[Snort-users] Problem with output file

Quentin Vallin quentin.vallin at ...16106...
Mon Feb 25 04:41:10 EST 2013


Oops sorry.

It's just because on my barnyard2.conf i have these line :

config gen_file:            /usr/local/snort/etc/gen-msg.map
config sid_file:            /usr/local/snort/etc/sid-msg.map

and when i would start barnyard2, i use this command line :

/usr/local/bin/barnyard2 -c /usr/local/snort/etc/barnyard2.conf -G 
/usr/local/snort/etc/gen-msg.map -S /usr/local/snort/etc/sid-msg.map -d 
/var/log/snort/ -f snort.u2 -w /var/log/snort/barnyard2.waldo -D

For it, i have declare 2 time the "gen-msg.map" and "sid-msg.map"

I just start without -G and -S option.

/usr/local/bin/barnyard2 -c /usr/local/snort/etc/barnyard2.conf -d 
/var/log/snort/ -f snort.u2 -w /var/log/snort/barnyard2.waldo -D

Regards.


Le 22/02/2013 16:55, Johnny Venter a écrit :
> Can you post the resolution to help others with similar issues?
>
>
> On Feb 21, 2013, at 7:26 AM, Quentin Vallin<quentin.vallin at ...16106...>  wrote:
>
>> Hello,
>>
>> I have post my problem on the IRC chanel  and beenph helped me.
>>
>> Thanks a lot Beenph
>>
>> Friendly,
>> Quentin.
>>
>> Le 21/02/2013 09:40, Quentin Vallin a écrit :
>>> Hello,
>>>
>>> I'm a new snort user. I have a problem with snort and barnyard2.
>>>
>>> When I lauch these software, i have some error in my syslog file like
>>> this :
>>> Feb 21 09:10:11 snort barnyard2[10298]: WARNING: While processing data
>>> parsed from SIGNATURE FILE a duplicate entry was found [DUPLICATE ARE
>>> NOT PROCESSED]:#012#011Generator ID:[1] #011Signature ID:[14464]
>>> #011Revision:[0] Classification ID:[0] #011 #012#011Message  [DELETED
>>> WEB-ACTIVEX IntraProcessLogging.Logger ActiveX function call access]
>>>
>>> Can you help me please ?
>>>
>>> Thank a lot,
>>>
>>> Friendly.
>>
>>
>> ------------------------------------------------------------------------------
>> Everyone hates slow websites. So do we.
>> Make your web apps faster with AppDynamics
>> Download AppDynamics Lite for free today:
>> http://p.sf.net/sfu/appdyn_d2d_feb
>> _______________________________________________
>> Snort-users mailing list
>> Snort-users at lists.sourceforge.net
>> Go to this URL to change user options or unsubscribe:
>> https://lists.sourceforge.net/lists/listinfo/snort-users
>> Snort-users list archive:
>> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>>
>> Please visit http://blog.snort.org to stay current on all the latest Snort news!
>






More information about the Snort-users mailing list