Snort IDS tips for VARs a

Barnyard processing logs for Snort

Even though Barnyard had six output plugins configured, only the alert plugins were active. Barnyard was processing a snort.alert.TIMESTAMP file, so the snort.log.TIMESTAMP file was ignored. Now we tell Barnyard to process that file.

Again we test Barnyard using the -R switch. I disabled all plugins but the two for processing log data.

Barnyard is ready to process the file.

cel433:/usr/local/snort-2.6.1.4# barnyard -c barnyard.conf -v -L /tmp/so/by -g gen-msg.map -s sid-msg.map -o /tmp/so/unified/snort.log.1180727255 Barnyard Version 0.2.0 (Build 32) Processing: /tmp/so/unified/snort.log.1180727255 Number of records: 1 Exiting

Two log records are created.

cel433:/tmp/so/by# ls -al | grep log
-rw-r--r--   1 root  wheel  1598 Jun  1 16:31 log_dump.by
-rw-r--r--   1 root  wheel   380 Jun  1 16:31 
log_pcap.by.2007-06-01@16-31-04

One is ASCII text and the other is Libpcap format.

cel433:/tmp/so/by# file log*
log_dump.by:                     ASCII text
log_pcap.by.2007-06-01@16-31-04: tcpdump capture file 
(little-endian) - version 2.4 (Ethernet, capture length 1514)

Here are the contents of log_dump.by, editing to conserve space.

The other file is in Libpcap format. Here I just show the header to conserve space.

As you can see, Barnyard can replicate the features found in the native Snort output modes.


Working with unified output

 Introduction
 Examining unified output
 Unified output readers
 Barnyard processing alerts
 Barnyard processing logs
 Barnyard working with databases

About the author
Richard Bejtlich is founder of TaoSecurity, author of several books on network security monitoring, including Extrusion Detection: Security Monitoring for Internal Intrusions, and operator of the TaoSecurity blog.


This was first published in July 2007

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: