<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.3.2">
<TITLE>Message</TITLE>
</HEAD>
<BODY>
To my knowledge, you can't. <BR>
<BR>
On Mon, 2005-03-14 at 08:29 -0800, Jim O'Leary wrote:<BR>
<BLOCKQUOTE TYPE=CITE>
<FONT SIZE="2"><FONT COLOR="#0000ff">That's right, I have several alert files in valid Snort text output. I need to convert these alert files into Snort's unified format.</FONT></FONT><BR>
<FONT COLOR="#000000"> </FONT><BR>
<FONT COLOR="#000000"> </FONT><BR>
<FONT SIZE="2"><FONT COLOR="#000000">-----Original Message-----</FONT></FONT><BR>
<B><FONT SIZE="2"><FONT COLOR="#000000">From:</FONT></FONT></B><FONT COLOR="#000000"><FONT SIZE="2"> snort-users-admin@lists.sourceforge.net [mailto:snort-users-admin@lists.sourceforge.net] </FONT></FONT><FONT COLOR="#000000"><B><FONT SIZE="2">On Behalf Of </FONT></B></FONT><FONT COLOR="#000000"><FONT SIZE="2">Esler, Joel CNTR/Sytex</FONT></FONT><BR>
<B><FONT SIZE="2"><FONT COLOR="#000000">Sent:</FONT></FONT></B><FONT COLOR="#000000"><FONT SIZE="2"> Monday, March 14, 2005 8:25 AM</FONT></FONT><BR>
<B><FONT SIZE="2"><FONT COLOR="#000000">To:</FONT></FONT></B><FONT COLOR="#000000"><FONT SIZE="2"> Jim O'Leary</FONT></FONT><BR>
<B><FONT SIZE="2"><FONT COLOR="#000000">Cc:</FONT></FONT></B><FONT COLOR="#000000"><FONT SIZE="2"> snort-users@lists.sourceforge.net</FONT></FONT><BR>
<B><FONT SIZE="2"><FONT COLOR="#000000">Subject:</FONT></FONT></B><FONT COLOR="#000000"><FONT SIZE="2"> RE: [Snort-users] Converting ASCII logs to Unified Format</FONT></FONT><BR>
<BR>
<BR>
<BLOCKQUOTE>
<FONT COLOR="#000000">So, I am guessing that you can an alert file you want to convert?</FONT><BR>
<BR>
<FONT COLOR="#000000">On Mon, 2005-03-14 at 08:19 -0800, Jim O'Leary wrote:</FONT><BR>
<BLOCKQUOTE TYPE=CITE>
<FONT SIZE="2"><FONT COLOR="#0000ff">I should clarify that I was given the Snort log files from an external source, not from my own Snort.conf. I need to convert these text files into unified so Barnyard can stick them into MySQL.</FONT></FONT><BR>
<BLOCKQUOTE>
<FONT SIZE="2"><FONT COLOR="#000000">-----Original Message-----</FONT></FONT><BR>
<B><FONT SIZE="2"><FONT COLOR="#000000">From:</FONT></FONT></B><FONT COLOR="#000000"><FONT SIZE="2"> Esler, Joel CNTR/Sytex [mailto:joel.esler@...9426...] </FONT></FONT><BR>
<B><FONT SIZE="2"><FONT COLOR="#000000">Sent:</FONT></FONT></B><FONT COLOR="#000000"><FONT SIZE="2"> Monday, March 14, 2005 8:16 AM</FONT></FONT><BR>
<B><FONT SIZE="2"><FONT COLOR="#000000">To:</FONT></FONT></B><FONT COLOR="#000000"><FONT SIZE="2"> Jim O'Leary</FONT></FONT><BR>
<B><FONT SIZE="2"><FONT COLOR="#000000">Cc:</FONT></FONT></B><FONT COLOR="#000000"><FONT SIZE="2"> snort-users@lists.sourceforge.net</FONT></FONT><BR>
<B><FONT SIZE="2"><FONT COLOR="#000000">Subject:</FONT></FONT></B><FONT COLOR="#000000"><FONT SIZE="2"> Re: [Snort-users] Converting ASCII logs to Unified Format</FONT></FONT><BR>
<BR>
<BR>
<FONT COLOR="#000000">Unified format is completely different from the ASCII log. I would double check your Snort.conf settings.</FONT><BR>
<BR>
<FONT COLOR="#000000">J</FONT><BR>
<BR>
<FONT COLOR="#000000">On Sat, 2005-03-12 at 22:03 -0800, Jim O'Leary wrote:</FONT><BR>
<BLOCKQUOTE TYPE=CITE>
<FONT SIZE="2"><FONT COLOR="#000000">I have Snort set up so that it outputs logs and alerts to the binary "unified" format. I also have barnyard set up so that it reads those binary files and sticks them into a MySQL database. </FONT></FONT><BR>
<FONT COLOR="#000000"> </FONT><BR>
<FONT SIZE="2"><FONT COLOR="#000000">The problem is, I've been given a group of Snort output files that are in the ASCII format. How do I convert these files to "unified" so I can get barnyard to stick them into MySQL?</FONT></FONT><BR>
<FONT COLOR="#000000"> </FONT><BR>
<FONT SIZE="2"><FONT COLOR="#000000">Thanks</FONT></FONT><FONT COLOR="#000000"> </FONT><BR>
</BLOCKQUOTE>
<TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
-- <BR>
Esler, Joel CNTR/Sytex <<A HREF="mailto:joel.esler@...9426...">joel.esler@...9426...</A>>
</TD>
</TR>
</TABLE>
</BLOCKQUOTE>
</BLOCKQUOTE>
<TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
-- <BR>
Esler, Joel CNTR/Sytex <<A HREF="mailto:joel.esler@...9426...">joel.esler@...9426...</A>>
</TD>
</TR>
</TABLE>
</BLOCKQUOTE>
</BLOCKQUOTE>
<TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
-- <BR>
Esler, Joel CNTR/Sytex <<A HREF="mailto:joel.esler@...9426...">joel.esler@...9426...</A>>
</TD>
</TR>
</TABLE>
</BODY>
</HTML>