Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need some help with my Snort/Barnyard2 setup. My goal is to have Snort send unified2 logs to Barnyard2 and then have Barnyard2 send the data to other locations. Here is my currrent setup.

OS

  • Scientific Linux 6

Snort Version

  • 2.9.2.3

Barnyard2 Version

  • 2.1.9

Snort command

snort -c /etc/snort/snort.conf -i eth2 &

Barnyard2 command

/usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -w /var/log/snort/barnyard.waldo &

snort.conf

output unified2: filename snort.log, limit 128

barnyard2.conf

output alert_syslog: host=127.0.0.1
output database: log, mysql, user=snort dbname=snort password=password host=localhost

With this setup, barnyard2 is showing all of the correct information in the database and I'm using BASE to view it on the web GUI. I was hoping to be able to send the full packet data to syslog with barnyard2 but after reading around, it seems that it is impossible to do that. So I then started trying to modify the snort.conf file and add lines like "output alert_full: alert.full". This definitely gave me a lot more information but still not the full packet data like I want.

So my question is, is there anyway I can use barnyard2 to send the full packet data of alerts to a human readable file? Since I can't send it directly to syslog, I can create another process to take the data from that file and ship it off to another server. If not, what flags and/or snort.conf configuration would you recommend to get the most data possible but still be able to handle quite a bit of traffic? In the end of it all, these alerts will be shipped to a central server via a SSH tunnel. I'm trying to stay away from databases.

share|improve this question
    
Is there any links describing the output file break down; the syslog file. Thanks –  user147508 Nov 29 '12 at 1:08

1 Answer 1

up vote 2 down vote accepted

I've done some additional research and found that using the latest version of Barnyard - firnsy-barnyard2-v2-1.10-beta2-28, gives me the additional logging I've wanted. It now has the ability to send full packet data to syslog. Below are the new options in the barnyard2.conf file.

output log_syslog_full: sensor_name snort-sensor, local, operation_mode default

OR

output log_syslog_full: sensor_name snort-sensor, local, operation_mode complete
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.