[Snort-users] Barnyard2 Failing on Write to SQL Database

Marcin Dulak marcin.dulak at gmail.com
Wed Feb 7 15:40:03 EST 2018


On Wed, Feb 7, 2018 at 8:41 PM, Jim Campbell <jim at w4bqp.net> wrote:

> I am having recurring failures of Barnyard2 to write to the SQL database.
> I am running Snort 2.9.9.0 on a Ubuntu 17.04 computer in inline mode. I
> modify the rules file /etc/snort/rules/snortd.rules to block packets rather
> than alert on them.
>
> Each time the failure occurrs, the /var/log/snort/snort.u2... file
> contains the same records at the beginning. I will add the beginning of the
> u2 file below.  Further down in the u2 file (below) it mentions a
> Silverlight update but the GID and SID don't match the ones in the u2 file.-
>
> Snort continues to run and write to the u2 file but since Barnyard2 is in
> a failed state I get nothing from Base.
>
> ========================================================
>
> My command line for Snort is: /usr/local/bin/snort -Q -q -u snort -g snort
> -c /etc/snort/snort.conf -i enp1s0:enp4s0
>
> My command line for Barnyard2 is: /usr/local/bin/barnyard2 -c
> /etc/snort/barnyard2.conf -d /var/log/snort -f snort.u2 -q -w
> /var/log/snort/barnyard2.waldo -a /var/log/snort/archived_logs/ -u root -g
> snort
>
> When I query the status of Barnyard2 after a failure I get:
>
> ● barnyard2.service - Barnyard2 Daemon
>    Loaded: loaded (/lib/systemd/system/barnyard2.service; enabled; vendor
> preset: enabled)
>    Active: failed (Result: exit-code) since Mon 2018-02-05 14:48:30 EST;
> 57min ago
>  Main PID: 27146 (code=exited, status=1/FAILURE)
>
> Feb 05 14:21:06 jim-IPS systemd[1]: Started Barnyard2 Daemon.
> Feb 05 14:48:30 jim-IPS barnyard2[27146]: ERROR: database mysql_error:
> Duplicate entry '69943-1' for key 'PRIMARY'
> Feb 05 14:48:30 jim-IPS barnyard2[27146]:         SQL=[INSERT INTO
> sig_reference (ref_id,sig_id,ref_seq) VALUES ('152087','69943','1');]
> Feb 05 14:48:30 jim-IPS barnyard2[27146]: Fatal Error, Quitting..
> Feb 05 14:48:30 jim-IPS systemd[1]: barnyard2.service: Main process
> exited, code=exited, status=1/FAILURE
> Feb 05 14:48:30 jim-IPS systemd[1]: barnyard2.service: Unit entered failed
> state.
> Feb 05 14:48:30 jim-IPS systemd[1]: barnyard2.service: Failed with result
> 'exit-code'.
>

since mysql claims it's duplicate maybe you can examine the contents of the
tables to see what 69943 corresponds to?
Other people reported that problem
https://github.com/firnsy/barnyard2/issues/208 but since barnyard is dead
probably nobody will answer.
I imagine mysql will start fine from that state, maybe you just need to
modify the systemd service file to restart the failed mysql automatically
and setup a monitoring system so you know how often this happens:
[Service]
Restart=on-failure

But really, look for a modern log analysis system and try
https://github.com/jasonish/evebox
Hopefully is not too late for evebox to support snort.

By the way is snort 2.9 able to log into json directly?
http://blog.snort.org/2017/11/snort-30-with-elasticsearch-logstash.html

Marcin


>
> I have scanned the rules file (/etc/snort/rules/snortd.rules) and don't
> find any occurrences of "152087" or "69943".
>
> Beginning of the output of u2spewfoo on the log file:
>
> (Event)
>         sensor id: 0    event id: 1     event second: 1517940080
> event microsecond: 56660
>         sig id: 16      gen id: 129     revision: 1 classification: 3
>         priority: 2     ip source: 34.215.60.2  ip destination:
> 192.168.254.2
>         src port: 80    dest port: 33804        protocol: 6 impact_flag:
> 32 blocked: 1
>
> Packet
>         sensor id: 0    event id: 1     event second: 1517940080
>         packet second: 1517940080       packet microsecond: 56660
>         linktype: 1     packet_length: 60
> [    0] B0 7F B9 1A 2E FF 00 26 91 56 78 0B 08 00 45 00 .......&.Vx...E.
> [   16] 00 28 A2 9D 40 00 EA 06 D0 AD 22 D7 3C 02 C0 A8 .(.. at .....".<...
> [   32] FE 02 00 50 84 0C 46 4E FA 61 00 74 2D 65 50 11 ...P..FN.a.t-eP.
> [   48] 75 40 2A 29 00 00 00 00 00 00 00 00 u@*)........
>
> (Event)
>         sensor id: 0    event id: 2     event second: 1517963742
> event microsecond: 913508
>         sig id: 4       gen id: 120     revision: 1 classification: 2
>         priority: 3     ip source: 72.21.81.240 ip destination:
> 192.168.254.2
>         src port: 80    dest port: 53900        protocol: 6 impact_flag:
> 32 blocked: 1
>
> Packet
>         sensor id: 0    event id: 2     event second: 1517963742
>         packet second: 1517963742       packet microsecond: 913508
>         linktype: 1     packet_length: 1514
> [    0] B0 7F B9 1A 2E FF 00 26 91 56 78 0B 08 00 45 00 .......&.Vx...E.
> [   16] 05 DC E7 49 40 00 36 06 FF 21 48 15 51 F0 C0 A8 ...I at .6..!H.Q...
> [   32] FE 02 00 50 D2 8C 7E 5D AB 65 4F 71 60 93 50 10 ...P..~].eOq`.P.
> [   48] 01 22 13 19 00 00 48 54 54 50 2F 31 2E 31 20 32 ."....HTTP/1.1 2
> [   64] 30 30 20 4F 4B 0D 0A 41 63 63 65 70 74 2D 52 61  00 OK..Accept-Ra
> [   80] 6E 67 65 73 3A 20 62 79 74 65 73 0D 0A 43 61 63  nges: bytes..Cac
> [   96] 68 65 2D 43 6F 6E 74 72 6F 6C 3A 20 70 75 62 6C he-Control: publ
> [  112] 69 63 2C 6D 61 78 2D 61 67 65 3D 31 37 32 38 30 ic,max-age=17280
> [  128] 30 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 0..Content-Type:
> [  144] 20 74 65 78 74 2F 70 6C 61 69 6E 0D 0A 44 61 74 text/plain..Dat
> [  160] 65 3A 20 57 65 64 2C 20 30 37 20 46 65 62 20 32  e: Wed, 07 Feb 2
> [  176] 30 31 38 20 30 30 3A 33 35 3A 34 32 20 47 4D 54  018 00:35:42 GMT
> [  192] 0D 0A 45 74 61 67 3A 20 22 38 30 34 33 35 31 35  ..Etag: "8043515
> [  208] 32 38 38 62 30 63 63 31 3A 30 22 0D 0A 4C 61 73 288b0cc1:0"..Las
> [  224] 74 2D 4D 6F 64 69 66 69 65 64 3A 20 46 72 69 2C t-Modified: Fri,
> [  240] 20 30 32 20 44 65 63 20 32 30 31 31 20 30 30 3A   02 Dec 2011 00:
> [  256] 32 31 3A 32 33 20 47 4D 54 0D 0A 53 65 72 76 65  21:23 GMT..Serve
>
>
> Thanks for any help,
>
> Jim
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.snort.org
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
> Please follow these rules: https://snort.org/faq/what-is-
> the-mailing-list-etiquette
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20180207/eb86274d/attachment-0001.html>


More information about the Snort-users mailing list