Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am currently using snort-2.9.3.1 outputting unified2 log format and using barnyard2-1.9 to process the alerts and send them to both syslog and a database. In some cases I have multiple instances of snort running on the same host and would like to log them separately.

Is there a way to configure barnyard2 such that depending on the input file name it will take different actions.

Something like,

 [snortmain_unified.log]
 output alert_syslog: LOG_AUTH LOG_ALERT

 [snortsecondary_unified.log
 output alert_syslog: LOG_LOCAL1 LOG_ERR

I am hoping to avoid running multiple instances of barnyard2.

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.