Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to get barnyard2 to take the unified2 output from snort and send a full syslog message to localhost but I cant seem to get it to work:
I am looking for a syslog message with as much information about the snort alert as possible. Something like this: Snort/Barnyard2-1.10 LOG_SYSLOG_FULL Output Logging
My barnyard2.conf looks like this: http://pastebin.com/KzLMQL1L

I lauch barnyard2 with the following command:

barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort/ -f snort_eth2* -w /var/log/snort/waldo

After launching I get the following messages:

WARNING: Ignoring corrupt/truncated waldofile '/var/log/snort/waldo'
Waiting for new spool file

As a result alerts are not read from my /var/log/snort folder. Any ideas where I am messing up?

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.