Re: Barnyard2 issue w/unified2 ?

[John Ives <jives () security berkeley edu>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Jeff,

My understanding from my own research is that for each instance of
snort on a system there needs to be an instance of barnyard2 each with
its own configuration file. Supposedly, that is all that is needed.
However, I have not been able to make it work as all but one of the
barnyards will eventually crash. Unfortunately, I have not had enough
time look for a fix, since moving to fewer systems running pf_ring
instead of a cluster of systems is a roadmap project. I will, however
be watching this thread with interest.

John

On 8/13/2013 6:11 PM, Jeff Kell wrote:
> On 8/13/2013 6:38 PM, Weir, Jason wrote:
> > I've experienced this issue when I mistakenly start a second
> > barnyard process without killing the original first.
> >
> > Make sure you only have 1 barnyard process running on each box
>
> OK, so how do you run multiple instances (connection-multiplexed
> PF_RING instances) without having multiple barnyard2 instances?
>
> Jeff
>
>
>
> ------------------------------------------------------------------------------
Get 100% visibility into Java/.NET code with AppDynamics Lite!
> It's a free troubleshooting tool designed for production. Get down
> to code-level detail for bottlenecks, with <2% overhead. Download
> for free and get started troubleshooting in minutes. 
> http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk
>
>
>
>
> _______________________________________________ Snort-users mailing
> list Snort-users () lists sourceforge net Go to this URL to change
> user options or unsubscribe: 
> https://lists.sourceforge.net/lists/listinfo/snort-users 
> Snort-users list archive: 
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
>  Please visit http://blog.snort.org to stay current on all the
> latest Snort news!


- -- 
- -------------------------------------------------------------------------
John Ives
System & Network Security                           Phone (510) 229-8676
University of California, Berkeley
- -------------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJSDPkzAAoJEJkidK6qbywsKfMIALXR4mnGia9Q+EpnfLPC/3w6
4XZ1tUVmsQ/y9+IsuIFiMijhZR79TBOMmsUVRg2mDxJSxND/2aIj/jXM2uFGMkj7
uQocHVN6rZftWzg89/pc4o2MRLfjUo2ltsoeqtJp3rpWqqPG8hGyXExSwBvyNXU7
heq6Sj6L5P1vVULWzKlJG3IiI+CKYce1G3eBfk5whRfXgnJu4M4HHeYBNH0e8OJs
7vCXt4lXPQ7WYwR7Fv20+qS0I6PpTAzu09ZDqOtsS90YZcrvjokz6pm7NTmvRxWE
NhFK4drQk/xkM8f0Ed8qN6ZNUGO+oBEi0tyFZM7OXJ16chv9+86ULqlH3bAEUQY=
=51dm
-----END PGP SIGNATURE-----

------------------------------------------------------------------------------
Get 100% visibility into Java/.NET code with AppDynamics Lite!
It's a free troubleshooting tool designed for production.
Get down to code-level detail for bottlenecks, with <2% overhead. 
Download for free and get started troubleshooting in minutes. 
http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!