Need help finding out why Barnyard2 doesnt take snort logs and put them in a mysql database

Question

Ok so using ubuntu 32 bit and running snort which I can see the u2 logs but Barnyard2 does not appear to be reading these files as nothing is the sql database.

So how can I test this? this is the command I use to run barnyard2 . "/barnyard2-install/bin/barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f .u2. -w /var/log/snort/barnyard2.waldo"

which I see no waldo file there so yeah Im really a newbie but I need to learn this stuff somehow.

For snort I just type service snort start. Im running as root and when I check mysql database its empyty. Can I write barnyards readings to a file?

Is there a place that might have the answers I seek? Is there a way to test this stuff?

Also u2spewfoo doesnt appear to be with my snort.

Answer 1

Fist of all snort should be able to generate the .u2 log as barnyard only reads the u2 logs. The barnyard configuration file should be set with the output module to log into the database with the right database name, password and username.. MySQL service should be running.(do check it). Waldo is a file that gets generate by initiating a barnyard command. Once you stopped the barnyard using CTRL+C and again initiate the command, it doesn't log the previously logged data, instead it logs new data. ".waldo" file is something like "TO BE CONTINUED".

Answer 2

If you configure your snort.conf ( to log as unified2) and barnyard.conf (to connect to mysql)correctly, try the following command to run snort and barnyard correctly and they will work together well:

to run snort:

snort -vde  --daq-dir=/usr/local/lib/daq/ --daq ipq -Q -c /etc/snort/snort.conf -l /var/log/snort -m 022

to run barnyard:

/usr/local/bin/barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.log -w /var/log/snort/barnyard.waldo

notice1: change the "/usr/local/bin" and other path to your barnyard and snort installation path.

notice2: if you did not install IPQ module ( enable it during configuring DAQ) delete "--daq ipd -Q" and at the end, you can use many guideline and manual to run snort and barnyard, some of them can be found in snort.org