Barnyard2 read snort unifed2 log file but does not write to log about barnyard2

[binf]

On Wed, Jan 30, 2013 at 4:46 AM, lutphi [email protected] wrote:

Hi I am a newbie on barnyard. I want barnyard to write log to a file like
snort-alert log.

In snort.con I got the line

output alert_unified2: filename snort.u2, limit 128

You need to use the following snort unified2 output directive for barnyard2
to process the unified2 file correctly.

output unified2: filename snort.u2, limit 128

If your unified2 file does not contain any events , then none of them will
get logged to the database.

Thus you need to ensure that you have events being written to your unified2
file if you want anything
to be written to the database.

[lutphi]

Thanks I changed my snort.conf just like you said. But situation is still the same and snort writes logs to new file "alerts". which is not unified2 the snort.con now likes,

#output alert_unified2: filename snort.u2, limit 128
output unified2: filename snort.u2, limit 128

and no snort.u2 file. But if I try to run snort as

output alert_unified2: filename snort.u2, limit 128
output unified2: filename snort.u2, limit 128

configuration options then snort writes to snort.u2 file.

And barnyard2 reads the file but does not write logs to file snort-alert.log

For snort I have test rule
alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001;)

There is no problem with snort in here

So what may be the problem here

[binf]

For snort to create a unified2 file supported by barnyard2 you need
only one line in the snort.conf.

output unified2: filename snort.u2, limit 128

filename option can vary depending on your needs.
limit option can vary depending on your needs also.

You will also need to delete previous created unified2 files.

Also you might want to run snort without the -p and the -N arguement

-p disabling promiscuous mode
and
-N being the nolog option (disalbling logging)

Also you might want to add a revision to your test rule if you want to log to database

alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001;) alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:1;)

Hope this helps, also we have a mailing list which is mabey more suited for this than gihub.

Search for barnyard2-users on google groups.

[lutphi]

thanks again I tried everthing but it still does not work.

I am already running snort with -N and -p options. I posted in barnyard2-users google group:)

https://groups.google.com/forum/?fromgroups=#!topic/barnyard2-users/371IMkL-_4Q

[terjehaarstad]

Hi there. Recently I had the same issue while using snort ips. I fixed the problem by deleting the waldo file, you could try that