<div dir="ltr">I've coppied the snort files, but now, I have this error !!!<br><br><br style="color: rgb(102, 51, 0);"><span style="color: rgb(102, 51, 0);">--== Initializing Barnyard2 ==--</span><br style="color: rgb(102, 51, 0);">
<span style="color: rgb(102, 51, 0);">Initializing Input Plugins!</span><br style="color: rgb(102, 51, 0);"><span style="color: rgb(102, 51, 0);">Initializing
Output Plugins!</span><br style="color: rgb(102, 51, 0);"><span style="color: rgb(102, 51, 0);">Parsing config file
"/etc/suricata/barnyard2.conf"</span><br style="color: rgb(102, 51, 0);">
<div class="im"><span style="color: rgb(102, 51, 0);">Log
directory = /var/log/barnyard2</span><br style="color: rgb(102, 51, 0);"><span style="color: rgb(102, 51, 0);">database: 'mysql' support is not
compiled into this build of snort</span><br style="color: rgb(102, 51, 0);">
<br style="color: rgb(102, 51, 0);"><span style="color: rgb(102, 51, 0);">ERROR: If this build of snort was obtained as a binary distribution
(e.g., rpm,</span><br style="color: rgb(102, 51, 0);"><span style="color: rgb(102, 51, 0);">or Windows), then check for alternate
builds that contains the necessary</span><br style="color: rgb(102, 51, 0);">
<span style="color: rgb(102, 51, 0);">'mysql' support.</span><br style="color: rgb(102, 51, 0);"><br style="color: rgb(102, 51, 0);"><span style="color: rgb(102, 51, 0);">If this build of snort was compiled by
you, then re-run the</span><br style="color: rgb(102, 51, 0);">
<span style="color: rgb(102, 51, 0);">the ./configure script using the
'--with-mysql' switch.</span><br style="color: rgb(102, 51, 0);"><span style="color: rgb(102, 51, 0);">For non-standard installations of a
database, the '--with-mysql=DIR'</span><br style="color: rgb(102, 51, 0);">
<span style="color: rgb(102, 51, 0);">syntax may need to be used to
specify the base directory of the DB install.</span><br style="color: rgb(102, 51, 0);"><br style="color: rgb(102, 51, 0);"><span style="color: rgb(102, 51, 0);">See the database documentation for
cursory details (doc/README.database).</span><br style="color: rgb(102, 51, 0);">
<span style="color: rgb(102, 51, 0);">and the URL to the most recent
database plugin documentation.</span><br style="color: rgb(102, 51, 0);"></div><span style="color: rgb(102, 51, 0);">Fatal Error, Quitting<br><br><span style="color: rgb(0, 0, 0);">what do you thing, is the problem ?</span><br>
</span><br><br><br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"><div dir="ltr"><div class="gmail_quote"><div><div class="h5">
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"><div dir="ltr"><div><div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div><div>
> ><br>
> ><br>
> > Selon "Anas.B" <<a href="mailto:a.bouhsaina@gmail.com" target="_blank">a.bouhsaina@gmail.com</a>>:<br>
> ><br>
> > > *Help me, please !*<br>
> > ><br>
> > > 2010/7/9 Anas.B <<a href="mailto:a.bouhsaina@gmail.com" target="_blank">a.bouhsaina@gmail.com</a>><br>
> > ><br>
> > > > Hello,<br>
> > > > Back :)<br>
> > > ><br>
> > > > Compiling Barnyard, I had this Error :<br>
> > > ><br>
> > > > --== Initializing Barnyard2 ==--<br>
> > > > Initializing Input Plugins!<br>
> > > > Initializing Output Plugins!<br>
> > > > Parsing config file "/etc/suricata/barnyard2.conf"<br>
> > > > ERROR: Unable to open Reference file '/etc/suricata/reference.config'<br>
> > (No<br>
> > > > such file or directory)<br>
> > > > ERROR: Unable to open Generator file "/etc/snort/gen-msg.map": No such<br>
> > file<br>
> > > > or directory<br>
> > > > ERROR: Unable to open SID file '/etc/snort/sid-msg.map' (No such file<br>
> > or<br>
> > > > directory)<br>
> > > > Log directory = /var/log/barnyard2<br>
> > > > database: 'mysql' support is not compiled into this build of snort<br>
> > > ><br>
> > > > ERROR: If this build of snort was obtained as a binary distribution<br>
> > (e.g.,<br>
> > > > rpm,<br>
> > > > or Windows), then check for alternate builds that contains the<br>
> > necessary<br>
> > > > 'mysql' support.<br>
> > > ><br>
> > > > If this build of snort was compiled by you, then re-run the<br>
> > > > the ./configure script using the '--with-mysql' switch.<br>
> > > > For non-standard installations of a database, the '--with-mysql=DIR'<br>
> > > > syntax may need to be used to specify the base directory of the DB<br>
> > install.<br>
> > > ><br>
> > > > See the database documentation for cursory details<br>
> > (doc/README.database).<br>
> > > > and the URL to the most recent database plugin documentation.<br>
> > > > Fatal Error, Quitting..<br>
> > > ><br>
> > > ><br>
> > > > Remind that in barnyard.conf we have :<br>
> > > > # set the appropriate paths to the file(s) your Snort process is using.<br>
> > > > #<br>
> > > > *config reference_file: /etc/suricata/reference.config*<br>
> > > > config classification_file: /etc/suricata/classification.config<br>
> > > > *config gen_file: /etc/snort/gen-msg.map<br>
> > > > config sid_file: /etc/snort/sid-msg.map*<br>
> > > ><br>
> > > > We don't have these files in suricata ! so how should i react !!!??<br>
> > > ><br>
> > > > best regards!<br>
> > > > A..<br>
> > > ><br>
> > > ><br>
> > > ><br>
> > > ><br>
> > > > 2010/7/8 Anas.B <<a href="mailto:a.bouhsaina@gmail.com" target="_blank">a.bouhsaina@gmail.com</a>><br>
> > > ><br>
> > > > Ah, I had a doubt about it,<br>
> > > >><br>
> > > >> Thank you, I will retry and tell u, results :)<br>
> > > >><br>
> > > >><br>
> > > >> Cheers.<br>
> > > >><br>
> > > >> Anas<br>
> > > >><br>
> > > >> 2010/7/8 Brant Wells <<a href="mailto:bwells@tfc.edu" target="_blank">bwells@tfc.edu</a>><br>
> > > >><br>
> > > >> The Barnyard download should have come with an example file in the<br>
> > > >>> download.... Inside of the download's folder, there is a<br>
> > barnyard.conf<br>
> > > file<br>
> > > >>> in ./etc -- I usually copy this to /etc/suricata/barnyard.conf and<br>
> > then<br>
> > > >>> modify as needed.<br>
> > > >>><br>
> > > >>> See Yas!<br>
> > > >>> ~Brant<br>
> > > >>><br>
> > > >>><br>
> > > >>> On Thu, Jul 8, 2010 at 9:57 AM, Anas.B <<a href="mailto:a.bouhsaina@gmail.com" target="_blank">a.bouhsaina@gmail.com</a>><br>
> > wrote:<br>
> > > >>><br>
> > > >>>> Hi Will,<br>
> > > >>>><br>
> > > >>>> I've dowlnloaded barnyard-0.2.0, but i didn't find "barnyard2.conf"<br>
> > > >>>><br>
> > > >>>> in Suricata.yaml,<br>
> > > >>>> we have already :<br>
> > > >>>><br>
> > > >>>><br>
> > > >>>> - unified-log:<br>
> > > >>>> enabled: yes<br>
> > > >>>> filename: unified.log<br>
> > > >>>><br>
> > > >>>> # Limit in MB.<br>
> > > >>>> #limit: 32<br>
> > > >>>><br>
> > > >>>><br>
> > > >>>> - unified-alert:<br>
> > > >>>> enabled: yes<br>
> > > >>>> filename: unified.alert<br>
> > > >>>><br>
> > > >>>> # Limit in MB.<br>
> > > >>>> #limit: 32<br>
> > > >>>><br>
> > > >>>> - unified2-alert:<br>
> > > >>>> enabled: yes<br>
> > > >>>><br>
> > > >>>><br>
> > > >>>> filename: unified2.alert<br>
> > > >>>><br>
> > > >>>> but how could we link between Suricata log folder and barnyard. ?<br>
> > > >>>> help me please.<br>
> > > >>>><br>
> > > >>>> Regards.<br>
> > > >>>><br>
> > > >>>> Anas<br>
> > > >>>><br>
> > > >>>><br>
> > > >>>> 2010/7/8 Will Metcalf <<a href="mailto:william.metcalf@gmail.com" target="_blank">william.metcalf@gmail.com</a>><br>
> > > >>>><br>
> > > >>>> unified1 logs are disabled by default have you enabled them in your<br>
> > > >>>>> suricata.yaml file? Also you need to change the -f snort.log to be<br>
> > -f<br>
> > > >>>>> unified.log. As as an fyi you should look at unified2/barnyard2 if<br>
> > you<br>
> > > >>>>> are doing a fresh install.<br>
> > > >>>>><br>
> > > >>>>> - unified-log:<br>
> > > >>>>> enabled: yes<br>
> > > >>>>> filename: unified.log<br>
> > > >>>>><br>
> > > >>>>> - unified-alert:<br>
> > > >>>>> enabled: yes<br>
> > > >>>>> filename: unified.alert<br>
> > > >>>>><br>
> > > >>>>> Regards,<br>
> > > >>>>><br>
> > > >>>>> Will<br>
> > > >>>>> On Thu, Jul 8, 2010 at 6:36 AM, Anas.B <<a href="mailto:a.bouhsaina@gmail.com" target="_blank">a.bouhsaina@gmail.com</a>><br>
> > wrote:<br>
> > > >>>>> > Hello everyone,<br>
> > > >>>>> ><br>
> > > >>>>> > I've installed mysql, created the database, with snort shemas<br>
> > > >>>>> (tables),,<br>
> > > >>>>> > also Barnyard,<br>
> > > >>>>> ><br>
> > > >>>>> ><br>
> > > >>>>> > in barnyard.conf :<br>
> > > >>>>> > I've replaced these lines :<br>
> > > >>>>> ><br>
> > > >>>>> > config hostname: debian<br>
> > > >>>>> > config interface: eth0<br>
> > > >>>>> > output log_acid_db: mysql, database snort, server localhost, user<br>
> > > >>>>> root,<br>
> > > >>>>> > password mysnortpassword, detail full<br>
> > > >>>>> ><br>
> > > >>>>> > But to launch Barnyard<br>
> > > >>>>> > I changed the command (snort) from this :<br>
> > > >>>>> ><br>
> > > >>>>> > # /usr/local/bin/barnyard \<br>
> > > >>>>> > -c /etc/snort/barnyard.conf \<br>
> > > >>>>> > -g /etc/snort/gen-msg.map \<br>
> > > >>>>> > -s /etc/snort/sid-msg.map \<br>
> > > >>>>> > -d /var/log/snort \<br>
> > > >>>>> > -f snort.log \<br>
> > > >>>>> > -w /etc/snort/barnyard.waldo &<br>
> > > >>>>> ><br>
> > > >>>>> > to this<br>
> > > >>>>> ><br>
> > > >>>>> > # /usr/local/bin/barnyard -c /etc/suricata/barnyard.conf -d<br>
> > > >>>>> > /var/log/suricata &<br>
> > > >>>>> ><br>
> > > >>>>> > But it dosen't work :s<br>
> > > >>>>> ><br>
> > > >>>>> > Can u help me,<br>
> > > >>>>> ><br>
> > > >>>>> > Regards.<br>
> > > >>>>> > Anas<br>
> > > >>>>> ><br>
> > > >>>>> > _______________________________________________<br>
> > > >>>>> > Oisf-users mailing list<br>
> > > >>>>> > <a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
> > > >>>>> ><br>
> > <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
> > > >>>>> ><br>
> > > >>>>> ><br>
> > > >>>>><br>
> > > >>>><br>
> > > >>>><br>
> > > >>>> _______________________________________________<br>
> > > >>>> Oisf-users mailing list<br>
> > > >>>> <a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
> > > >>>> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
> > > >>>><br>
> > > >>>><br>
> > > >>><br>
> > > >><br>
> > > ><br>
> > ><br>
> ><br>
> ><br>
> ><br>
><br>
<br>
<br>
</div></div></blockquote></div><br></div></div></div>
</blockquote></div></div></div><br></div>
</blockquote></div><br></div>