Home / server / Questions / 405400
Accepted
Eric
Asked: 2012-07-07 06:30:19 +0800 CST

Snort/Barnyard2 Logging

  • 772

I need some help with my Snort/Barnyard2 setup. My goal is to have Snort send unified2 logs to Barnyard2 and then have Barnyard2 send the data to other locations. Here is my currrent setup.

OS

  • Scientific Linux 6

Snort Version

  • 2.9.2.3

Barnyard2 Version

  • 2.1.9

Snort command

snort -c /etc/snort/snort.conf -i eth2 &

Barnyard2 command

/usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -w /var/log/snort/barnyard.waldo &

snort.conf

output unified2: filename snort.log, limit 128

barnyard2.conf

output alert_syslog: host=127.0.0.1
output database: log, mysql, user=snort dbname=snort password=password host=localhost

With this setup, barnyard2 is showing all of the correct information in the database and I'm using BASE to view it on the web GUI. I was hoping to be able to send the full packet data to syslog with barnyard2 but after reading around, it seems that it is impossible to do that. So I then started trying to modify the snort.conf file and add lines like "output alert_full: alert.full". This definitely gave me a lot more information but still not the full packet data like I want.

So my question is, is there anyway I can use barnyard2 to send the full packet data of alerts to a human readable file? Since I can't send it directly to syslog, I can create another process to take the data from that file and ship it off to another server. If not, what flags and/or snort.conf configuration would you recommend to get the most data possible but still be able to handle quite a bit of traffic? In the end of it all, these alerts will be shipped to a central server via a SSH tunnel. I'm trying to stay away from databases.

snort

1 Answers

  1. Best Answer

    I've done some additional research and found that using the latest version of Barnyard - firnsy-barnyard2-v2-1.10-beta2-28, gives me the additional logging I've wanted. It now has the ability to send full packet data to syslog. Below are the new options in the barnyard2.conf file.

    output log_syslog_full: sensor_name snort-sensor, local, operation_mode default

    OR

    output log_syslog_full: sensor_name snort-sensor, local, operation_mode complete
    • 2