Re: [Snort-users] barnyard 2.0.0 & snort-2.8.1

Replying to myself ;)

Seconds after posting I had an inspiration and found that the output
line was missing in the config for this sensor so snort must have been
using the new output format.

What reads the new format? Clearly barnyard does not...

Russell

On 27/04/2008, at 10:20 AM, Russell Fulton wrote:
> On just one of my sensors I am having problems with barnyard refusing
> to read snort log files:
>
> Apr 27 10:14:55 monitor-dmzi barnyard[12240]: Opened spool file '/
> home/
> snort/data/eth2//snort.log.1209245479'
> Apr 27 10:14:55 monitor-dmzi barnyard[12240]: FATAL ERROR: ERROR: No
> input plugin found for magic: a1b2c3d4
>
> So far as I can tell the set up is the same as of at least two other
> sensors which work fine.
>
> Any idea what is gong on?
>
> Russell
>
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
> Don't miss this year's exciting event. There's still time to save
> $100.
> Use priority code J8TL2D2.
> http://ad.doubleclick.net/clk;198757...un.com/javaone
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/...fo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.p...st=snort-users


-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757...un.com/javaone
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users