<div dir="ltr"><span style="color: rgb(153, 0, 0);"><font color="#000000">Thank youuu<br>there's progress <img goomoji="330" style="margin: 0pt 0.2ex; vertical-align: middle;" src="cid:330@goomoji.gmail"></font> <br></span><div>
<span style="color: rgb(153, 0, 0);"><br><span style="color: rgb(0, 0, 0);">but still a </span></span><span style="color: rgb(0, 0, 0);">Fatal Error,</span><br><span style="color: rgb(153, 0, 0);"><br> --== Initializing Barnyard2 ==--</span><br style="color: rgb(153, 0, 0);">
<span style="color: rgb(153, 0, 0);">Initializing Input Plugins!</span><br style="color: rgb(153, 0, 0);"><span style="color: rgb(153, 0, 0);">Initializing Output Plugins!</span><br style="color: rgb(153, 0, 0);"><span style="color: rgb(153, 0, 0);">Parsing config file "/etc/suricata/barnyard2.conf"</span><br style="color: rgb(153, 0, 0);">
<span style="color: rgb(153, 0, 0);">Log directory = /var/log/barnyard2</span><br style="color: rgb(153, 0, 0);"><span style="color: rgb(153, 0, 0);">database: compiled support for (mysql)</span><br style="color: rgb(153, 0, 0);">
<span style="color: rgb(153, 0, 0);">database: configured to use mysql</span><br style="color: rgb(153, 0, 0);"><span style="color: rgb(153, 0, 0);">database: schema version = 107</span><br style="color: rgb(153, 0, 0);">
<span style="color: rgb(153, 0, 0);">database: host = localhost</span><br style="color: rgb(153, 0, 0);"><span style="color: rgb(153, 0, 0);">database: user = root</span><br style="color: rgb(153, 0, 0);">
<span style="color: rgb(153, 0, 0);">database: database name = snort</span><br style="color: rgb(153, 0, 0);"><span style="color: rgb(153, 0, 0);">database: sensor name = localhost:eth0</span><br style="color: rgb(153, 0, 0);">
<span style="color: rgb(153, 0, 0);">database: sensor id = 1</span><br style="color: rgb(153, 0, 0);"><span style="color: rgb(153, 0, 0);">database: data encoding = hex</span><br style="color: rgb(153, 0, 0);"><span style="color: rgb(153, 0, 0);">database: detail level = full</span><br style="color: rgb(153, 0, 0);">
<span style="color: rgb(153, 0, 0);">database: ignore_bpf = no</span><br style="color: rgb(153, 0, 0);"><span style="color: rgb(153, 0, 0);">database: using the "alert" facility</span><br style="color: rgb(153, 0, 0);">
<br style="color: rgb(153, 0, 0);"><span style="color: rgb(153, 0, 0);"> --== Initialization Complete ==--</span><br style="color: rgb(153, 0, 0);"><br style="color: rgb(153, 0, 0);"><span style="color: rgb(153, 0, 0);"> ______ -*> Barnyard2 <*-</span><br style="color: rgb(153, 0, 0);">
<span style="color: rgb(153, 0, 0);"> / ,,_ \ Version 2.1.8 (Build 251)</span><br style="color: rgb(153, 0, 0);"><span style="color: rgb(153, 0, 0);"> |o" )~| By the SecurixLive.com Team: <a href="http://www.securixlive.com/about.php">http://www.securixlive.com/about.php</a></span><br style="color: rgb(153, 0, 0);">
<span style="color: rgb(153, 0, 0);"> + '''' + (C) Copyright 2008-2010 SecurixLive.</span><br style="color: rgb(153, 0, 0);"><br style="color: rgb(153, 0, 0);"><span style="color: rgb(153, 0, 0);"> Snort by Martin Roesch & The Snort Team: <a href="http://www.snort.org/team.html">http://www.snort.org/team.html</a></span><br style="color: rgb(153, 0, 0);">
<span style="color: rgb(153, 0, 0);"> (C) Copyright 1998-2007 Sourcefire Inc., et al.</span><br style="color: rgb(153, 0, 0);"><br style="color: rgb(153, 0, 0);"><span style="color: rgb(153, 0, 0);">Opened spool file '/var/log/suricata//unified.log.1275900067'</span><br style="color: rgb(153, 0, 0);">
<span style="color: rgb(153, 0, 0);">ERROR: Unknown record type read: 2148576734</span><br style="color: rgb(153, 0, 0);"><span style="color: rgb(153, 0, 0);">Fatal Error, Quitting.</span>.<br><br>this is the command that I set<br>
<br><b># barnyard2 -c /etc/suricata/barnyard2.conf -d /var/log/suricata/ -f unified.log</b><br><br><br><br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div><div class="h5">
<br>
Selon "Anas.B" <<a href="mailto:a.bouhsaina@gmail.com">a.bouhsaina@gmail.com</a>>:<br>
<br>
> Yes, I have just reapeted the operation.<br>
><br>
> That's what i did<br>
> *<br>
> and<br>
><br>
> root@ubuntu:/usr/local/barnyard2-1.8# make*<br>
> I had like these errors :<br>
> make[2]: Entering directory `/usr/local/barnyard2-1.8/etc'<br>
> make[2]: Nothing to be done for `all'.<br>
> make[2]: Leaving directory `/usr/local/barnyard2-1.8/etc'<br>
> Making all in doc<br>
> make[2]: Entering directory `/usr/local/barnyard2-1.8/doc'<br>
> make[2]: Nothing to be done for `all'.<br>
> make[2]: Leaving directory `/usr/local/barnyard2-1.8/doc'<br>
> Making all in rpm<br>
> make[2]: Entering directory `/usr/local/barnyard2-1.8/rpm'<br>
> make[2]: Nothing to be done for `all'.<br>
> make[2]: Leaving directory `/usr/local/barnyard2-1.8/rpm'<br>
> Making all in schemas<br>
> make[2]: Entering directory `/usr/local/barnyard2-1.8/schemas'<br>
> make[2]: Nothing to be done for `all'.<br>
> make[2]: Leaving directory `/usr/local/barnyard2-1.8/schemas'<br>
> Making all in m4<br>
> make[2]: Entering directory `/usr/local/barnyard2-1.8/m4'<br>
> make[2]: Nothing to be done for `all'.<br>
> make[2]: Leaving directory `/usr/local/barnyard2-1.8/m4'<br>
> make[2]: Entering directory `/usr/local/barnyard2-1.8'<br>
> make[2]: Leaving directory `/usr/local/barnyard2-1.8'<br>
> make[1]: Leaving directory `/usr/local/barnyard2-1.8'<br>
><br>
><br>
> and *#make install*<br>
><br>
> I had like these errors :<br>
><br>
> Making install in schemas<br>
> make[1]: Entering directory `/usr/local/barnyard2-1.8/schemas'<br>
> make[2]: Entering directory `/usr/local/barnyard2-1.8/schemas'<br>
> make[2]: Nothing to be done for `install-exec-am'.<br>
> make[2]: Nothing to be done for `install-data-am'.<br>
> make[2]: Leaving directory `/usr/local/barnyard2-1.8/schemas'<br>
> make[1]: Leaving directory `/usr/local/barnyard2-1.8/schemas'<br>
> Making install in m4<br>
> make[1]: Entering directory `/usr/local/barnyard2-1.8/m4'<br>
> make[2]: Entering directory `/usr/local/barnyard2-1.8/m4'<br>
> make[2]: Nothing to be done for `install-exec-am'.<br>
> make[2]: Nothing to be done for `install-data-am'.<br>
> make[2]: Leaving directory `/usr/local/barnyard2-1.8/m4'<br>
> make[1]: Leaving directory `/usr/local/barnyard2-1.8/m4'<br>
> make[1]: Entering directory `/usr/local/barnyard2-1.8'<br>
> make[2]: Entering directory `/usr/local/barnyard2-1.8'<br>
> make[2]: Nothing to be done for `install-exec-am'.<br>
> make[2]: Nothing to be done for `install-data-am'.<br>
> make[2]: Leaving directory `/usr/local/barnyard2-1.8'<br>
> make[1]: Leaving directory `/usr/local/barnyard2-1.8'<br>
><br>
><br>
><br>
><br>
> 2010/7/12 Brant Wells <<a href="mailto:bwells@tfc.edu">bwells@tfc.edu</a>><br>
><br>
> > Did you compile Barnyard2 yourself?<br>
> ><br>
> > You should make sure to...<br>
> ><br>
> > ./configure --with-mysql<br>
> ><br>
> > when you build Barnyard 2... and make sure that reference.config,<br>
> > gen-msg.map and sid-msg.map have all been copied into /etc/suricata!<br>
> ><br>
> > Let me know what happens!<br>
> > ~Brant<br>
> ><br>
> ><br>
> > On Mon, Jul 12, 2010 at 6:11 AM, Anas.B <<a href="mailto:a.bouhsaina@gmail.com">a.bouhsaina@gmail.com</a>> wrote:<br>
> ><br>
> >> I have just the database's name as "snort".<br>
> >><br>
> >> still this error :<br>
> >><br>
> >> --== Initializing Barnyard2 ==--<br>
> >> Initializing Input Plugins!<br>
> >> Initializing Output Plugins!<br>
> >> Parsing config file "/etc/suricata/barnyard2.conf"<br>
> >> ERROR: Unable to open Reference file '/etc/suricata/reference.config' (No<br>
> >> such file or directory)<br>
> >> ERROR: Unable to open Generator file "/etc/suricata/gen-msg.map": No such<br>
> >> file or directory<br>
> >> ERROR: Unable to open SID file '/etc/suricata/sid-msg.map' (No such file<br>
> >> or directory)<br>
> >><br>
> >> Log directory = /var/log/barnyard2<br>
> >> database: 'mysql' support is not compiled into this build of snort<br>
> >><br>
> >> ERROR: If this build of snort was obtained as a binary distribution (e.g.,<br>
> >> rpm,<br>
> >> or Windows), then check for alternate builds that contains the necessary<br>
> >> 'mysql' support.<br>
> >><br>
> >> If this build of snort was compiled by you, then re-run the<br>
> >> the ./configure script using the '--with-mysql' switch.<br>
> >> For non-standard installations of a database, the '--with-mysql=DIR'<br>
> >> syntax may need to be used to specify the base directory of the DB<br>
> >> install.<br>
> >><br>
> >> See the database documentation for cursory details (doc/README.database).<br>
> >> and the URL to the most recent database plugin documentation.<br>
> >> Fatal Error, Quitting..<br>
> >><br>
> >><br>
> >> we don't have these files in Suricata :<br>
> >> '/etc/suricata/reference.config' (No such file or directory)<br>
> >> ERROR: Unable to open Generator file "/etc/suricata/gen-msg.map": No such<br>
> >> file or directory<br>
> >> ERROR: Unable to open SID file '/etc/suricata/sid-msg.map'<br>
> >> !!!<br>
> >><br>
> >><br>
> >><br>
> >>>><br>
> >>>> Selon "Anas.B" <<a href="mailto:a.bouhsaina@gmail.com">a.bouhsaina@gmail.com</a>>:<br>
> >>>><br>
> >>>> > *Help me, please !*<br>
> >>>><br>
> >>>> ><br>
> >>>> > 2010/7/9 Anas.B <<a href="mailto:a.bouhsaina@gmail.com">a.bouhsaina@gmail.com</a>><br>
> >>>> ><br>
> >>>> > > Hello,<br>
> >>>> > > Back :)<br>
> >>>> > ><br>
> >>>> > > Compiling Barnyard, I had this Error :<br>
> >>>> > ><br>
> >>>> > > --== Initializing Barnyard2 ==--<br>
> >>>> > > Initializing Input Plugins!<br>
> >>>> > > Initializing Output Plugins!<br>
> >>>> > > Parsing config file "/etc/suricata/barnyard2.conf"<br>
> >>>> > > ERROR: Unable to open Reference file<br>
> >>>> '/etc/suricata/reference.config' (No<br>
> >>>> > > such file or directory)<br>
> >>>> > > ERROR: Unable to open Generator file "/etc/snort/gen-msg.map": No<br>
> >>>> such file<br>
> >>>> > > or directory<br>
> >>>> > > ERROR: Unable to open SID file '/etc/snort/sid-msg.map' (No such<br>
> >>>> file or<br>
> >>>> > > directory)<br>
> >>>> > > Log directory = /var/log/barnyard2<br>
> >>>> > > database: 'mysql' support is not compiled into this build of snort<br>
> >>>> > ><br>
> >>>> > > ERROR: If this build of snort was obtained as a binary distribution<br>
> >>>> (e.g.,<br>
> >>>> > > rpm,<br>
> >>>> > > or Windows), then check for alternate builds that contains the<br>
> >>>> necessary<br>
> >>>> > > 'mysql' support.<br>
> >>>> > ><br>
> >>>> > > If this build of snort was compiled by you, then re-run the<br>
> >>>> > > the ./configure script using the '--with-mysql' switch.<br>
> >>>> > > For non-standard installations of a database, the '--with-mysql=DIR'<br>
> >>>> > > syntax may need to be used to specify the base directory of the DB<br>
> >>>> install.<br>
> >>>> > ><br>
> >>>> > > See the database documentation for cursory details<br>
> >>>> (doc/README.database).<br>
> >>>> > > and the URL to the most recent database plugin documentation.<br>
> >>>> > > Fatal Error, Quitting..<br>
> >>>> > ><br>
> >>>> > ><br>
> >>>> > > Remind that in barnyard.conf we have :<br>
> >>>> > > # set the appropriate paths to the file(s) your Snort process is<br>
> >>>> using.<br>
> >>>> > > #<br>
> >>>> > > *config reference_file: /etc/suricata/reference.config*<br>
> >>>> > > config classification_file: /etc/suricata/classification.config<br>
> >>>> > > *config gen_file: /etc/snort/gen-msg.map<br>
> >>>> > > config sid_file: /etc/snort/sid-msg.map*<br>
> >>>> > ><br>
> >>>> > > We don't have these files in suricata ! so how should i react !!!??<br>
> >>>> > ><br>
> >>>> > > best regards!<br>
> >>>> > > A..<br>
> >>>> > ><br>
> >>>> > ><br>
> >>>> > ><br>
> >>>> > ><br>
> >>>> > > 2010/7/8 Anas.B <<a href="mailto:a.bouhsaina@gmail.com">a.bouhsaina@gmail.com</a>><br>
> >>>> > ><br>
> >>>> > > Ah, I had a doubt about it,<br>
> >>>> > >><br>
> >>>> > >> Thank you, I will retry and tell u, results :)<br>
> >>>> > >><br>
> >>>> > >><br>
> >>>> > >> Cheers.<br>
> >>>> > >><br>
> >>>> > >> Anas<br>
> >>>> > >><br>
> >>>> > >> 2010/7/8 Brant Wells <<a href="mailto:bwells@tfc.edu">bwells@tfc.edu</a>><br>
> >>>> > >><br>
> >>>> > >> The Barnyard download should have come with an example file in the<br>
> >>>> > >>> download.... Inside of the download's folder, there is a<br>
> >>>> barnyard.conf<br>
> >>>> > file<br>
> >>>> > >>> in ./etc -- I usually copy this to /etc/suricata/barnyard.conf<br>
> >>>> and then<br>
> >>>> > >>> modify as needed.<br>
> >>>> > >>><br>
> >>>> > >>> See Yas!<br>
> >>>> > >>> ~Brant<br>
> >>>> > >>><br>
> >>>> > >>><br>
> >>>> > >>> On Thu, Jul 8, 2010 at 9:57 AM, Anas.B <<a href="mailto:a.bouhsaina@gmail.com">a.bouhsaina@gmail.com</a>><br>
> >>>> wrote:<br>
> >>>> > >>><br>
> >>>> > >>>> Hi Will,<br>
> >>>> > >>>><br>
> >>>> > >>>> I've dowlnloaded barnyard-0.2.0, but i didn't find<br>
> >>>> "barnyard2.conf"<br>
> >>>> > >>>><br>
> >>>> > >>>> in Suricata.yaml,<br>
> >>>> > >>>> we have already :<br>
> >>>> > >>>><br>
> >>>> > >>>><br>
> >>>> > >>>> - unified-log:<br>
> >>>> > >>>> enabled: yes<br>
> >>>> > >>>> filename: unified.log<br>
> >>>> > >>>><br>
> >>>> > >>>> # Limit in MB.<br>
> >>>> > >>>> #limit: 32<br>
> >>>> > >>>><br>
> >>>> > >>>><br>
> >>>> > >>>> - unified-alert:<br>
> >>>> > >>>> enabled: yes<br>
> >>>> > >>>> filename: unified.alert<br>
> >>>> > >>>><br>
> >>>> > >>>> # Limit in MB.<br>
> >>>> > >>>> #limit: 32<br>
> >>>> > >>>><br>
> >>>> > >>>> - unified2-alert:<br>
> >>>> > >>>> enabled: yes<br>
> >>>> > >>>><br>
> >>>> > >>>><br>
> >>>> > >>>> filename: unified2.alert<br>
> >>>> > >>>><br>
> >>>> > >>>> but how could we link between Suricata log folder and barnyard. ?<br>
> >>>> > >>>> help me please.<br>
> >>>> > >>>><br>
> >>>> > >>>> Regards.<br>
> >>>> > >>>><br>
> >>>> > >>>> Anas<br>
> >>>> > >>>><br>
> >>>> > >>>><br>
> >>>> > >>>> 2010/7/8 Will Metcalf <<a href="mailto:william.metcalf@gmail.com">william.metcalf@gmail.com</a>><br>
> >>>> > >>>><br>
> >>>> > >>>> unified1 logs are disabled by default have you enabled them in<br>
> >>>> your<br>
> >>>> > >>>>> suricata.yaml file? Also you need to change the -f snort.log to<br>
> >>>> be -f<br>
> >>>> > >>>>> unified.log. As as an fyi you should look at unified2/barnyard2<br>
> >>>> if you<br>
> >>>> > >>>>> are doing a fresh install.<br>
> >>>> > >>>>><br>
> >>>> > >>>>> - unified-log:<br>
> >>>> > >>>>> enabled: yes<br>
> >>>> > >>>>> filename: unified.log<br>
> >>>> > >>>>><br>
> >>>> > >>>>> - unified-alert:<br>
> >>>> > >>>>> enabled: yes<br>
> >>>> > >>>>> filename: unified.alert<br>
> >>>> > >>>>><br>
> >>>> > >>>>> Regards,<br>
> >>>> > >>>>><br>
> >>>> > >>>>> Will<br>
> >>>> > >>>>> On Thu, Jul 8, 2010 at 6:36 AM, Anas.B <<a href="mailto:a.bouhsaina@gmail.com">a.bouhsaina@gmail.com</a>><br>
> >>>> wrote:<br>
> >>>> > >>>>> > Hello everyone,<br>
> >>>> > >>>>> ><br>
> >>>> > >>>>> > I've installed mysql, created the database, with snort shemas<br>
> >>>> > >>>>> (tables),,<br>
> >>>> > >>>>> > also Barnyard,<br>
> >>>> > >>>>> ><br>
> >>>> > >>>>> ><br>
> >>>> > >>>>> > in barnyard.conf :<br>
> >>>> > >>>>> > I've replaced these lines :<br>
> >>>> > >>>>> ><br>
> >>>> > >>>>> > config hostname: debian<br>
> >>>> > >>>>> > config interface: eth0<br>
> >>>> > >>>>> > output log_acid_db: mysql, database snort, server localhost,<br>
> >>>> user<br>
> >>>> > >>>>> root,<br>
> >>>> > >>>>> > password mysnortpassword, detail full<br>
> >>>> > >>>>> ><br>
> >>>> > >>>>> > But to launch Barnyard<br>
> >>>> > >>>>> > I changed the command (snort) from this :<br>
> >>>> > >>>>> ><br>
> >>>> > >>>>> > # /usr/local/bin/barnyard<br>
> >>>> > >>>>> > -c /etc/snort/barnyard.conf<br>
> >>>> > >>>>> > -g /etc/snort/gen-msg.map<br>
> >>>> > >>>>> > -s /etc/snort/sid-msg.map<br>
> >>>> > >>>>> > -d /var/log/snort<br>
> >>>> > >>>>> > -f snort.log<br>
> >>>> > >>>>> > -w /etc/snort/barnyard.waldo &<br>
> >>>> > >>>>> ><br>
> >>>> > >>>>> > to this<br>
> >>>> > >>>>> ><br>
> >>>> > >>>>> > # /usr/local/bin/barnyard -c /etc/suricata/barnyard.conf -d<br>
> >>>> > >>>>> > /var/log/suricata &<br>
> >>>> > >>>>> ><br>
> >>>> > >>>>> > But it dosen't work :s<br>
> >>>> > >>>>> ><br>
> >>>> > >>>>> > Can u help me,<br>
> >>>> > >>>>> ><br>
> >>>> > >>>>> > Regards.<br>
> >>>> > >>>>> > Anas<br>
> >>>> > >>>>> ><br>
> >>>> > >>>>> > _______________________________________________<br>
> >>>> > >>>>> > Oisf-users mailing list<br>
> >>>> > >>>>> > <a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
> >>>> > >>>>> ><br>
> >>>> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
> >>>> > >>>>> ><br>
> >>>> > >>>>> ><br>
> >>>> > >>>>><br>
> >>>> > >>>><br>
> >>>> > >>>><br>
> >>>> > >>>> _______________________________________________<br>
> >>>> > >>>> Oisf-users mailing list<br>
> >>>> > >>>> <a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
> >>>> > >>>><br>
> >>>> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
> >>>> > >>>><br>
> >>>> > >>>><br>
> >>>> > >>><br>
> >>>> > >><br>
> >>>> > ><br>
> >>>> ><br>
> >>>><br>
> >>>><br>
> >>>><br>
> >>><br>
> >><br>
> >><br>
> >> _______________________________________________<br>
> >> Oisf-users mailing list<br>
> >> <a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
> >> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
> >><br>
> >><br>
> ><br>
><br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
</div></div></blockquote></div><br></div></div>