Re: Unified2

[Joel Esler <jesler () sourcefire com>]

On Sep 18, 2012, at 12:03 PM, PR <oly562 () gmail com> wrote:

> 1. does barnyard2 take what is in /var/log/snort/snort.unified2 and write that output that to mysql?
Yes.  Among other capabilities, that's it's main use.


> 2. can snort.conf do logging to database with:
>
> output database: alert, mysql, user=snort password=xxxxxx dbname=snort host=localhost
> output database: log, mysql, user=snort password=xxxxxx dbname=snort host=localhost

Not anymore.  We removed that in 2.9.3.0

> instead of barnyard2.conf
>
> 3. if so, should i turn off unified2 in snort.conf and only use
>
> output database: alert, mysql, user=snort password=xxxxxx dbname=snort host=localhost
> output database: log, mysql, user=snort password=xxxxxx dbname=snort host=localhost

No. Even if you are using an older version of Snort, in order to insert into the DB, Snort has to stop what it's doing 
in other areas and input into the db.  While this may be very fast, an IDS should be an IDS.  Not a database insert 
tool.  The database output method was written as a college project back in the mid nineties, and shouldn't be used.

> 4. why is barnyard2 needed, and being promoted over oinkmaster or at all? pls explain. 

Apples and Oranges.  Barnyard2 manages output from Snort.  It takes the alerts from Snort and it outputs to the 
database.  (Or whatever other output function you choose).  Oinkmaster is a rule management tool, and has also been (at 
least I recommend) replaced by pulledpork, as the latter has a much greater feature set to be able to properly manage a 
Snort ruleset.

--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!