<div dir="ltr"><div> Hello,<br>Back :)<br><br>Compiling Barnyard, I had this Error :<br><br><span style="color: rgb(102, 0, 0);">--== Initializing Barnyard2 ==--</span><br style="color: rgb(102, 0, 0);"><span style="color: rgb(102, 0, 0);">Initializing Input Plugins!</span><br style="color: rgb(102, 0, 0);">
<span style="color: rgb(102, 0, 0);">Initializing Output Plugins!</span><br style="color: rgb(102, 0, 0);"><span style="color: rgb(102, 0, 0);">Parsing config file "/etc/suricata/barnyard2.conf"</span><br style="color: rgb(102, 0, 0);">
<span style="color: rgb(102, 0, 0);">ERROR: Unable to open Reference file '/etc/suricata/reference.config' (No such file or directory)</span><br style="color: rgb(102, 0, 0);"><span style="color: rgb(102, 0, 0);">ERROR: Unable to open Generator file "/etc/snort/gen-msg.map": No such file or directory</span><br style="color: rgb(102, 0, 0);">
<span style="color: rgb(102, 0, 0);">ERROR: Unable to open SID file '/etc/snort/sid-msg.map' (No such file or directory)</span><br style="color: rgb(102, 0, 0);"><span style="color: rgb(102, 0, 0);">Log directory = /var/log/barnyard2<br>
database: 'mysql' support is not compiled into this build of snort<br><br>ERROR: If this build of snort was obtained as a binary distribution (e.g., rpm,<br>or Windows), then check for alternate builds that contains the necessary<br>
'mysql' support.<br><br>If this build of snort was compiled by you, then re-run the<br>the ./configure script using the '--with-mysql' switch.<br>For non-standard installations of a database, the '--with-mysql=DIR'<br>
syntax may need to be used to specify the base directory of the DB install.<br><br>See the database documentation for cursory details (doc/README.database).<br>and the URL to the most recent database plugin documentation.<br>
Fatal Error, Quitting..</span><br><br><br>Remind that in barnyard.conf we have :<br># set the appropriate paths to the file(s) your Snort process is using.<br>#<br></div><b style="color: rgb(255, 0, 0);">config reference_file: /etc/suricata/reference.config</b><br>
config classification_file: /etc/suricata/classification.config<br><b style="color: rgb(255, 0, 0);">config gen_file: /etc/snort/gen-msg.map<br>config sid_file: /etc/snort/sid-msg.map</b><br><br>We don't have these files in suricata ! so how should i react !!!??<br>
<br>best regards!<br><span style="color: rgb(153, 153, 153);">A..</span><br><br><br><br><br><div class="gmail_quote">2010/7/8 Anas.B <span dir="ltr"><<a href="mailto:a.bouhsaina@gmail.com">a.bouhsaina@gmail.com</a>></span><br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"><div dir="ltr">Ah, I had a doubt about it,<br><br>Thank you, I will retry and tell u, results :)<br>
<br><br>Cheers.<br><br><span style="color: rgb(192, 192, 192);">Anas</span><br><br><div class="gmail_quote">2010/7/8 Brant Wells <span dir="ltr"><<a href="mailto:bwells@tfc.edu" target="_blank">bwells@tfc.edu</a>></span><div>
<div></div><div class="h5"><br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">The Barnyard download should have come with an example file in the download.... Inside of the download's folder, there is a barnyard.conf file in ./etc -- I usually copy this to /etc/suricata/barnyard.conf and then modify as needed.<div>
<br></div><div>See Yas!<br><font color="#888888">~Brant</font></div><div><div></div><div><div><br><div><br><div class="gmail_quote">On Thu, Jul 8, 2010 at 9:57 AM, Anas.B <span dir="ltr"><<a href="mailto:a.bouhsaina@gmail.com" target="_blank">a.bouhsaina@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"><div dir="ltr">Hi Will, <br><br>I've dowlnloaded barnyard-0.2.0, but i didn't find "barnyard2.conf"<br>
<br>in Suricata.yaml,<br>we have already :<div><br><br><span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"> - unified-log:</span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);">
<span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"> enabled: yes</span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"><span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"> filename: unified.log</span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);">
<br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"></div><span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"> <span style="color: rgb(0, 153, 0);"> # Limit in MB.</span></span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 153, 0);">
<span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 153, 0);"> #limit: 32</span><div><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);">
<span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"> - unified-alert:</span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"><span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"> enabled: yes</span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);">
<span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"> filename: unified.alert</span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 153, 0);">
</div><span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 153, 0);"> # Limit in MB.</span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 153, 0);"><span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 153, 0);"> #limit: 32</span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);">
<br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"><span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"> - unified2-alert:</span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);">
<span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"> enabled: yes</span><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"><br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);">
<br style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"><span style="font-family: arial,helvetica,sans-serif; color: rgb(0, 0, 153);"> filename: unified2.alert</span><br><br>but how could we link between Suricata log folder and barnyard. ?<br>
help me please.<br><br>Regards.<br><br><span style="color: rgb(153, 153, 153);">Anas</span><br><br><br><div class="gmail_quote">2010/7/8 Will Metcalf <span dir="ltr"><<a href="mailto:william.metcalf@gmail.com" target="_blank">william.metcalf@gmail.com</a>></span><div>
<div></div><div><br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">unified1 logs are disabled by default have you enabled them in your<br>
suricata.yaml file? Also you need to change the -f snort.log to be -f<br>
unified.log. As as an fyi you should look at unified2/barnyard2 if you<br>
are doing a fresh install.<br>
<br>
- unified-log:<br>
enabled: yes<br>
filename: unified.log<br>
<br>
- unified-alert:<br>
enabled: yes<br>
filename: unified.alert<br>
<br>
Regards,<br>
<br>
Will<br>
<div><div></div><div>On Thu, Jul 8, 2010 at 6:36 AM, Anas.B <<a href="mailto:a.bouhsaina@gmail.com" target="_blank">a.bouhsaina@gmail.com</a>> wrote:<br>
> Hello everyone,<br>
><br>
> I've installed mysql, created the database, with snort shemas (tables),,<br>
> also Barnyard,<br>
><br>
><br>
> in barnyard.conf :<br>
> I've replaced these lines :<br>
><br>
> config hostname: debian<br>
> config interface: eth0<br>
> output log_acid_db: mysql, database snort, server localhost, user root,<br>
> password mysnortpassword, detail full<br>
><br>
> But to launch Barnyard<br>
> I changed the command (snort) from this :<br>
><br>
> # /usr/local/bin/barnyard \<br>
> -c /etc/snort/barnyard.conf \<br>
> -g /etc/snort/gen-msg.map \<br>
> -s /etc/snort/sid-msg.map \<br>
> -d /var/log/snort \<br>
> -f snort.log \<br>
> -w /etc/snort/barnyard.waldo &<br>
><br>
> to this<br>
><br>
> # /usr/local/bin/barnyard -c /etc/suricata/barnyard.conf -d<br>
> /var/log/suricata &<br>
><br>
> But it dosen't work :s<br>
><br>
> Can u help me,<br>
><br>
> Regards.<br>
> Anas<br>
><br>
</div></div>> _______________________________________________<br>
> Oisf-users mailing list<br>
> <a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
><br>
><br>
</blockquote></div></div></div><br></div>
<br>_______________________________________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
<br></blockquote></div><br></div></div>
</div></div></blockquote></div></div></div><br></div>
</blockquote></div><br></div>