Sarajevo, Bosnia and Herzegovina

Snort with Barnyard2 on Ubuntu 12.04

Well I had some problems on my server with config files for Snort and Barnyard so I will write short explanation here.

First in /etc/snort/snort.conf define output like

output unified2: filename snort.u2, limit 128

Then in /usr/local/etc/barnyard2.conf define output to database with :

output database: log, mysql, user=snort_user password=snort dbname=snortdb host=
output database: alert, mysql, user=snort_user password=snort dbname=snortdb host=

and finally run all of them in a daemon mode :

snort -c /etc/snort/snort.conf -D

after this command you should see in your log (/var/log/snort) file snort.u2 and barnyard will use that file end import that data to mysql.

barnyard2 -c /etc/snort/barnyard.conf -d /var/log/snort -f snort.u2 -w /var/log/snort/barnyard2.waldo -D

Why do you use barnyard2 at all?

Because it will take too much time for snort to record all the data directly to database so it is easier for snort to write it to data (in binary format like .u2) and then use barnyard to import that data to mysql database or other. You can find a lot of explanations in snort manual :