Snort Forums Archive

Archive Home » Third Party Tools » Barnyard 0.2 alert_csv not producing output

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

Barnyard 0.2 alert_csv not producing output

Posted by nero3100 on August 05, 2005 07:45:54

I am running snort 2.4, barnyard 0.2, on FreeBSD 5.4. My goal is to product a csv_out file of alert information and a tcp dump file of the associated tcp streams. I'm choosing to do this through barnyard because I am on a high bandwidth pipe (1gb/s using a metanetworks nic)

In barnyard.conf, have commented out all output's, and uncommented output alert_csv (default csv entries). I am using the waldo file to pick up the snort.log file.

In snort.conf, the only output modules i have are output alert_unified, and output log_unified to produce the snort.alert.xx, and snort.log.xx.

When I envoke log_pcap, it does produce information from barnyard, so it's working. But I just can't get a alert_csv file to generate.

Any suggestions.