Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently using snort- outputting unified2 log format and using barnyard2-1.9 to process the alerts and send them to both syslog and a database. In some cases I have multiple instances of snort running on the same host and would like to log them separately.

Is there a way to configure barnyard2 such that depending on the input file name it will take different actions.

Something like,

 output alert_syslog: LOG_AUTH LOG_ALERT

 output alert_syslog: LOG_LOCAL1 LOG_ERR

I am hoping to avoid running multiple instances of barnyard2.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.