<div dir="ltr">Ah, I had a doubt about it,<br><br>Thank you, I will retry and tell u, results :)<br><br><br>Cheers.<br><br><span style="color: rgb(192, 192, 192);">Anas</span><br><br><div class="gmail_quote">2010/7/8 Brant Wells <span dir="ltr"><<a href="mailto:bwells@tfc.edu">bwells@tfc.edu</a>></span><br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">The Barnyard download should have come with an example file in the download.... Inside of the download's folder, there is a barnyard.conf file in ./etc -- I usually copy this to /etc/suricata/barnyard.conf and then modify as needed.<div>
<br></div><div>See Yas!<br><font color="#888888">~Brant</font></div><div><div></div><div class="h5"><div><br><div><br><div class="gmail_quote">On Thu, Jul 8, 2010 at 9:57 AM, Anas.B <span dir="ltr"><<a href="mailto:a.bouhsaina@gmail.com" target="_blank">a.bouhsaina@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"><div dir="ltr">Hi Will, <br><br>I've dowlnloaded barnyard-0.2.0, but i didn't find "barnyard2.conf"<br>
<br>in Suricata.yaml,<br>we have already :<div><br><br><span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"> - unified-log:</span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);">
<span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"> enabled: yes</span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"><span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"> filename: unified.log</span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);">
<br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"></div><span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"> <span style="color: rgb(0, 153, 0);"> # Limit in MB.</span></span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 153, 0);">
<span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 153, 0);"> #limit: 32</span><div><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);">
<span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"> - unified-alert:</span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"><span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"> enabled: yes</span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);">
<span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"> filename: unified.alert</span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 153, 0);">
</div><span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 153, 0);"> # Limit in MB.</span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 153, 0);"><span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 153, 0);"> #limit: 32</span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);">
<br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"><span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"> - unified2-alert:</span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);">
<span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"> enabled: yes</span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);">
<br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"><span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"> filename: unified2.alert</span><br><br>but how could we link between Suricata log folder and barnyard. ?<br>
help me please.<br><br>Regards.<br><br><span style="color: rgb(153, 153, 153);">Anas</span><br><br><br><div class="gmail_quote">2010/7/8 Will Metcalf <span dir="ltr"><<a href="mailto:william.metcalf@gmail.com" target="_blank">william.metcalf@gmail.com</a>></span><div>
<div></div><div><br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">unified1 logs are disabled by default have you enabled them in your<br>
suricata.yaml file? Also you need to change the -f snort.log to be -f<br>
unified.log. As as an fyi you should look at unified2/barnyard2 if you<br>
are doing a fresh install.<br>
<br>
- unified-log:<br>
enabled: yes<br>
filename: unified.log<br>
<br>
- unified-alert:<br>
enabled: yes<br>
filename: unified.alert<br>
<br>
Regards,<br>
<br>
Will<br>
<div><div></div><div>On Thu, Jul 8, 2010 at 6:36 AM, Anas.B <<a href="mailto:a.bouhsaina@gmail.com" target="_blank">a.bouhsaina@gmail.com</a>> wrote:<br>
> Hello everyone,<br>
><br>
> I've installed mysql, created the database, with snort shemas (tables),,<br>
> also Barnyard,<br>
><br>
><br>
> in barnyard.conf :<br>
> I've replaced these lines :<br>
><br>
> config hostname: debian<br>
> config interface: eth0<br>
> output log_acid_db: mysql, database snort, server localhost, user root,<br>
> password mysnortpassword, detail full<br>
><br>
> But to launch Barnyard<br>
> I changed the command (snort) from this :<br>
><br>
> # /usr/local/bin/barnyard \<br>
> -c /etc/snort/barnyard.conf \<br>
> -g /etc/snort/gen-msg.map \<br>
> -s /etc/snort/sid-msg.map \<br>
> -d /var/log/snort \<br>
> -f snort.log \<br>
> -w /etc/snort/barnyard.waldo &<br>
><br>
> to this<br>
><br>
> # /usr/local/bin/barnyard -c /etc/suricata/barnyard.conf -d<br>
> /var/log/suricata &<br>
><br>
> But it dosen't work :s<br>
><br>
> Can u help me,<br>
><br>
> Regards.<br>
> Anas<br>
><br>
</div></div>> _______________________________________________<br>
> Oisf-users mailing list<br>
> <a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
><br>
><br>
</blockquote></div></div></div><br></div>
<br>_______________________________________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
<br></blockquote></div><br></div></div>
</div></div></blockquote></div><br></div>