Otdfbt

Was this seat-belt sign activation standard procedure?

With today's technology, could iron be smelted at La Rinconada?

Wireless headphones interfere with Wi-Fi signal on laptop

Who commanded or executed this action in Game of Thrones S8E5?

Why doesn't Iron Man's action affect this person in Endgame?

tikz drawing rectangle discretized with triangle lattices and its centroids

Why did Varys remove his rings?

How to handle professionally if colleagues has referred his relative and asking to take easy while taking interview

Was the dragon prowess intentionally downplayed in S08E04?

Formal Definition of Dot Product

How to not get blinded by an attack at dawn

Network latencies between opposite ends of the Earth

Do people who work at research institutes consider themselves "academics"?

Why is the German word for "cartridge" "die Patrone"?

Is there an academic word that means "to split hairs over"?

Could there be something like aerobatic smoke trails in the vacuum of space?

Meaning of "legitimate" in Carl Jung's quote "Neurosis is always a substitute for legitimate suffering."

Why were the bells ignored in S8E5?

Do crew rest seats count towards the maximum allowed number of seats per flight attendant?

Why do galaxies collide

Is there any deeper thematic meaning to the white horse that Arya finds in The Bells (S08E05)?

What metal is most suitable for a ladder submerged in an underground water tank?

Should generated documentation be stored in a Git repository?

Proper way to use apply_filters() with class functions?

Why do my Snort logs appear to be empty?

Where is the location of snort.confspecifying snort output files?Snort: not logging anythingSnort/Barnyard2 Loggingsnort intrusion detectionsnort-mysql not starting on Ubuntu serverConfiguring Barnyard2 Output Plug-In Per Input SourceSnort not sending alert log file to syslog server?Snort: Unable to open rules fileWhy doesn't Snort match on DNS response?

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

4

So I was following this guide on how to install Snort, Barnyard 2 and the like.

I've set up Snort so it would run automatically, by editing the rc.local file:

ifconfig eth1 up

/usr/local/snort/bin/snort -D -u snort -g snort 
-c /usr/local/snort/etc/snort.conf -i eth1
/usr/local/bin/barnyard2 -c /usr/local/snort/etc/barnyard2.conf 
-d /var/log/snort 
-f snort.u2 
-w /var/log/snort/barnyard2.waldo 
-D

And I then restarted the computer. Snort was able to run and detect the attack, but the log files (including barnyard2.waldo) remained blank, even if a new log entry was created for each attack.

I'm not sure what went wrong here, since it's supposed to log any attacks and store it in the log directory, right?

Then, I tried changing the parameter to:

 /usr/local/snort/bin/snort -D -b -u snort -g snort 
-c /usr/local/snort/etc/snort.conf -i eth1

And when I checked the log file, there are two log files, one in u2 and another in tcpdump format, but they're both blank and is approximately 0 bytes.

So I thought I'd run it from the console to see if it would work from there, using this command:

/usr/local/snort/bin/snort -A full -u snort -g snort 

-c /usr/local/snort/etc/snort.conf -i eth1

and I then checked the log file to see if it would log the attack, and it still doesn't.

snort

share|improve this question

edited May 16 '14 at 4:43

hdr

asked May 13 '14 at 12:29

hdrhdr

48127

add a comment | 

4

So I was following this guide on how to install Snort, Barnyard 2 and the like.

I've set up Snort so it would run automatically, by editing the rc.local file:

ifconfig eth1 up

/usr/local/snort/bin/snort -D -u snort -g snort 
-c /usr/local/snort/etc/snort.conf -i eth1
/usr/local/bin/barnyard2 -c /usr/local/snort/etc/barnyard2.conf 
-d /var/log/snort 
-f snort.u2 
-w /var/log/snort/barnyard2.waldo 
-D

And I then restarted the computer. Snort was able to run and detect the attack, but the log files (including barnyard2.waldo) remained blank, even if a new log entry was created for each attack.

I'm not sure what went wrong here, since it's supposed to log any attacks and store it in the log directory, right?

Then, I tried changing the parameter to:

 /usr/local/snort/bin/snort -D -b -u snort -g snort 
-c /usr/local/snort/etc/snort.conf -i eth1

And when I checked the log file, there are two log files, one in u2 and another in tcpdump format, but they're both blank and is approximately 0 bytes.

So I thought I'd run it from the console to see if it would work from there, using this command:

/usr/local/snort/bin/snort -A full -u snort -g snort 

-c /usr/local/snort/etc/snort.conf -i eth1

and I then checked the log file to see if it would log the attack, and it still doesn't.

snort

share|improve this question

edited May 16 '14 at 4:43

hdr

asked May 13 '14 at 12:29

hdrhdr

48127

add a comment | 

So I was following this guide on how to install Snort, Barnyard 2 and the like.

I've set up Snort so it would run automatically, by editing the rc.local file:

ifconfig eth1 up

/usr/local/snort/bin/snort -D -u snort -g snort 
-c /usr/local/snort/etc/snort.conf -i eth1
/usr/local/bin/barnyard2 -c /usr/local/snort/etc/barnyard2.conf 
-d /var/log/snort 
-f snort.u2 
-w /var/log/snort/barnyard2.waldo 
-D

And I then restarted the computer. Snort was able to run and detect the attack, but the log files (including barnyard2.waldo) remained blank, even if a new log entry was created for each attack.

I'm not sure what went wrong here, since it's supposed to log any attacks and store it in the log directory, right?

Then, I tried changing the parameter to:

 /usr/local/snort/bin/snort -D -b -u snort -g snort 
-c /usr/local/snort/etc/snort.conf -i eth1

And when I checked the log file, there are two log files, one in u2 and another in tcpdump format, but they're both blank and is approximately 0 bytes.

So I thought I'd run it from the console to see if it would work from there, using this command:

/usr/local/snort/bin/snort -A full -u snort -g snort 

-c /usr/local/snort/etc/snort.conf -i eth1

and I then checked the log file to see if it would log the attack, and it still doesn't.

snort

share|improve this question

edited May 16 '14 at 4:43

hdr

asked May 13 '14 at 12:29

hdrhdr

48127

ifconfig eth1 up

/usr/local/snort/bin/snort -D -u snort -g snort 
-c /usr/local/snort/etc/snort.conf -i eth1
/usr/local/bin/barnyard2 -c /usr/local/snort/etc/barnyard2.conf 
-d /var/log/snort 
-f snort.u2 
-w /var/log/snort/barnyard2.waldo 
-D

 /usr/local/snort/bin/snort -D -b -u snort -g snort 
-c /usr/local/snort/etc/snort.conf -i eth1

/usr/local/snort/bin/snort -A full -u snort -g snort 

-c /usr/local/snort/etc/snort.conf -i eth1

share|improve this question

edited May 16 '14 at 4:43

hdr

asked May 13 '14 at 12:29

hdrhdr

48127

share|improve this question

edited May 16 '14 at 4:43

hdr

asked May 13 '14 at 12:29

hdrhdr

48127

asked May 13 '14 at 12:29

hdrhdr

48127

asked May 13 '14 at 12:29

hdrhdr

48127

2 Answers
2

active

oldest

votes

0

Please check the permissions of the logfiles and the logdirectory.

possible snort is not able to write into that file/directory

share|improve this answer

answered May 13 '14 at 12:43

Dennis NolteDennis Nolte

2,40632133

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Here's what the file permissions look like in /var/log/snort ls -l /var/log/snort total 0 -rw-r--r-- 1 root root 0 Mei 12 23:52 alert -rw-r--r-- 1 snort snort 0 Apr 26 17:51 barnyard2.waldo -rw------- 1 snort snort 0 Mei 13 08:58 snort.log.1399942704 -rw------- 1 snort snort 0 Mei 13 09:00 snort.log.1399942834 -rw------- 1 snort snort 0 Mei 13 21:02 snort.log.1399986140
  
  – hdr
  May 13 '14 at 13:27
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @hdr please change the permissions so you are able to write in the directory. for a short test do chmod o+w /var/log/snort and restart snort. (maybe /var/ and /var/log/ aswell) this is just for testing! when this works you should change either the snort user or the permissions for /var/log/snort/
  
  – Dennis Nolte
  May 13 '14 at 14:11
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Sorry for the late reply, the internet connection crapped out the whole day for some reason. But, when I tried your suggestion is still doesn't work. However, when I started Snort from the console instead from a Daemon, I noticed this: Reputation config: WARNING: Can't find any whitelist/blacklist entries. Reputation Preprocessor disabled. Do you think this might be the cause of the problems?
  
  – hdr
  May 14 '14 at 2:14
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Update: So I re-downloaded the Snort Ruleset file and recreated and reconfigured the entries, (and also applied chmod on the /var/ directory), but it seems the problem's still there.
  
  – hdr
  May 14 '14 at 4:00
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  sorry out of ideas, the error you get seems to be not related to your issue based on a few google entries.
  
  – Dennis Nolte
  May 14 '14 at 7:08
  

  
  
  
  

add a comment | 

0

Seems like you have nostamp specified in your snort.config. Find the line output unified2: filename snort.log, limit 128 and make sure it doesn't look like:
output unified2: filename snort.log, limit 128, nostamp

share|improve this answer

answered Mar 28 '15 at 21:29

DrewDrew

1011

add a comment | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f594772%2fwhy-do-my-snort-logs-appear-to-be-empty%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

0

Please check the permissions of the logfiles and the logdirectory.

possible snort is not able to write into that file/directory

share|improve this answer

answered May 13 '14 at 12:43

Dennis NolteDennis Nolte

2,40632133

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Here's what the file permissions look like in /var/log/snort ls -l /var/log/snort total 0 -rw-r--r-- 1 root root 0 Mei 12 23:52 alert -rw-r--r-- 1 snort snort 0 Apr 26 17:51 barnyard2.waldo -rw------- 1 snort snort 0 Mei 13 08:58 snort.log.1399942704 -rw------- 1 snort snort 0 Mei 13 09:00 snort.log.1399942834 -rw------- 1 snort snort 0 Mei 13 21:02 snort.log.1399986140
  
  – hdr
  May 13 '14 at 13:27
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @hdr please change the permissions so you are able to write in the directory. for a short test do chmod o+w /var/log/snort and restart snort. (maybe /var/ and /var/log/ aswell) this is just for testing! when this works you should change either the snort user or the permissions for /var/log/snort/
  
  – Dennis Nolte
  May 13 '14 at 14:11
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Sorry for the late reply, the internet connection crapped out the whole day for some reason. But, when I tried your suggestion is still doesn't work. However, when I started Snort from the console instead from a Daemon, I noticed this: Reputation config: WARNING: Can't find any whitelist/blacklist entries. Reputation Preprocessor disabled. Do you think this might be the cause of the problems?
  
  – hdr
  May 14 '14 at 2:14
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Update: So I re-downloaded the Snort Ruleset file and recreated and reconfigured the entries, (and also applied chmod on the /var/ directory), but it seems the problem's still there.
  
  – hdr
  May 14 '14 at 4:00
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  sorry out of ideas, the error you get seems to be not related to your issue based on a few google entries.
  
  – Dennis Nolte
  May 14 '14 at 7:08
  

  
  
  
  

add a comment | 

0

Please check the permissions of the logfiles and the logdirectory.

possible snort is not able to write into that file/directory

share|improve this answer

answered May 13 '14 at 12:43

Dennis NolteDennis Nolte

2,40632133

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Here's what the file permissions look like in /var/log/snort ls -l /var/log/snort total 0 -rw-r--r-- 1 root root 0 Mei 12 23:52 alert -rw-r--r-- 1 snort snort 0 Apr 26 17:51 barnyard2.waldo -rw------- 1 snort snort 0 Mei 13 08:58 snort.log.1399942704 -rw------- 1 snort snort 0 Mei 13 09:00 snort.log.1399942834 -rw------- 1 snort snort 0 Mei 13 21:02 snort.log.1399986140
  
  – hdr
  May 13 '14 at 13:27
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  @hdr please change the permissions so you are able to write in the directory. for a short test do chmod o+w /var/log/snort and restart snort. (maybe /var/ and /var/log/ aswell) this is just for testing! when this works you should change either the snort user or the permissions for /var/log/snort/
  
  – Dennis Nolte
  May 13 '14 at 14:11
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Sorry for the late reply, the internet connection crapped out the whole day for some reason. But, when I tried your suggestion is still doesn't work. However, when I started Snort from the console instead from a Daemon, I noticed this: Reputation config: WARNING: Can't find any whitelist/blacklist entries. Reputation Preprocessor disabled. Do you think this might be the cause of the problems?
  
  – hdr
  May 14 '14 at 2:14
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Update: So I re-downloaded the Snort Ruleset file and recreated and reconfigured the entries, (and also applied chmod on the /var/ directory), but it seems the problem's still there.
  
  – hdr
  May 14 '14 at 4:00
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  sorry out of ideas, the error you get seems to be not related to your issue based on a few google entries.
  
  – Dennis Nolte
  May 14 '14 at 7:08
  

  
  
  
  

add a comment | 

Please check the permissions of the logfiles and the logdirectory.

possible snort is not able to write into that file/directory

share|improve this answer

answered May 13 '14 at 12:43

Dennis NolteDennis Nolte

2,40632133

share|improve this answer

answered May 13 '14 at 12:43

Dennis NolteDennis Nolte

2,40632133

answered May 13 '14 at 12:43

Dennis NolteDennis Nolte

2,40632133

answered May 13 '14 at 12:43

Dennis NolteDennis Nolte

2,40632133

0

Seems like you have nostamp specified in your snort.config. Find the line output unified2: filename snort.log, limit 128 and make sure it doesn't look like:
output unified2: filename snort.log, limit 128, nostamp

share|improve this answer

answered Mar 28 '15 at 21:29

DrewDrew

1011

add a comment | 

0

Seems like you have nostamp specified in your snort.config. Find the line output unified2: filename snort.log, limit 128 and make sure it doesn't look like:
output unified2: filename snort.log, limit 128, nostamp

share|improve this answer

answered Mar 28 '15 at 21:29

DrewDrew

1011

add a comment | 

Seems like you have nostamp specified in your snort.config. Find the line output unified2: filename snort.log, limit 128 and make sure it doesn't look like:
output unified2: filename snort.log, limit 128, nostamp

share|improve this answer

answered Mar 28 '15 at 21:29

DrewDrew

1011

share|improve this answer

answered Mar 28 '15 at 21:29

DrewDrew

1011

answered Mar 28 '15 at 21:29

DrewDrew

1011

answered Mar 28 '15 at 21:29

DrewDrew

1011