I am trying to get barnyard2 to take the unified2 output from snort and send a full syslog message to localhost but I cant seem to get it to work:
I am looking for a syslog message with as much information about the snort alert as possible. Something like this: Snort/Barnyard2-1.10 LOG_SYSLOG_FULL Output Logging
My barnyard2.conf looks like this: http://pastebin.com/KzLMQL1L
I lauch barnyard2 with the following command:
barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort/ -f snort_eth2* -w /var/log/snort/waldo
After launching I get the following messages:
WARNING: Ignoring corrupt/truncated waldofile '/var/log/snort/waldo' Waiting for new spool file
As a result alerts are not read from my /var/log/snort folder. Any ideas where I am messing up?