Snort mailing list archives

Previous By Date Next
Previous By Thread Next

Re: Barnyard2 Failing on Write to SQL Database

From: Marcin Dulak via Snort-users <snort-users () lists snort org>
Date: Wed, 7 Feb 2018 21:40:03 +0100
On Wed, Feb 7, 2018 at 8:41 PM, Jim Campbell <jim () w4bqp net> wrote:


I am having recurring failures of Barnyard2 to write to the SQL database.
I am running Snort 2.9.9.0 on a Ubuntu 17.04 computer in inline mode. I
modify the rules file /etc/snort/rules/snortd.rules to block packets rather
than alert on them.

Each time the failure occurrs, the /var/log/snort/snort.u2... file
contains the same records at the beginning. I will add the beginning of the
u2 file below.  Further down in the u2 file (below) it mentions a
Silverlight update but the GID and SID don't match the ones in the u2 file.-

Snort continues to run and write to the u2 file but since Barnyard2 is in
a failed state I get nothing from Base.

========================================================

My command line for Snort is: /usr/local/bin/snort -Q -q -u snort -g snort
-c /etc/snort/snort.conf -i enp1s0:enp4s0

My command line for Barnyard2 is: /usr/local/bin/barnyard2 -c
/etc/snort/barnyard2.conf -d /var/log/snort -f snort.u2 -q -w
/var/log/snort/barnyard2.waldo -a /var/log/snort/archived_logs/ -u root -g
snort

When I query the status of Barnyard2 after a failure I get:

● barnyard2.service - Barnyard2 Daemon
   Loaded: loaded (/lib/systemd/system/barnyard2.service; enabled; vendor
preset: enabled)
   Active: failed (Result: exit-code) since Mon 2018-02-05 14:48:30 EST;
57min ago
 Main PID: 27146 (code=exited, status=1/FAILURE)

Feb 05 14:21:06 jim-IPS systemd[1]: Started Barnyard2 Daemon.
Feb 05 14:48:30 jim-IPS barnyard2[27146]: ERROR: database mysql_error:
Duplicate entry '69943-1' for key 'PRIMARY'
Feb 05 14:48:30 jim-IPS barnyard2[27146]:         SQL=[INSERT INTO
sig_reference (ref_id,sig_id,ref_seq) VALUES ('152087','69943','1');]
Feb 05 14:48:30 jim-IPS barnyard2[27146]: Fatal Error, Quitting..
Feb 05 14:48:30 jim-IPS systemd[1]: barnyard2.service: Main process
exited, code=exited, status=1/FAILURE
Feb 05 14:48:30 jim-IPS systemd[1]: barnyard2.service: Unit entered failed
state.
Feb 05 14:48:30 jim-IPS systemd[1]: barnyard2.service: Failed with result
'exit-code'.



since mysql claims it's duplicate maybe you can examine the contents of the
tables to see what 69943 corresponds to?
Other people reported that problem
https://github.com/firnsy/barnyard2/issues/208 but since barnyard is dead
probably nobody will answer.
I imagine mysql will start fine from that state, maybe you just need to
modify the systemd service file to restart the failed mysql automatically
and setup a monitoring system so you know how often this happens:
[Service]
Restart=on-failure

But really, look for a modern log analysis system and try
https://github.com/jasonish/evebox
Hopefully is not too late for evebox to support snort.

By the way is snort 2.9 able to log into json directly?
http://blog.snort.org/2017/11/snort-30-with-elasticsearch-logstash.html

Marcin




I have scanned the rules file (/etc/snort/rules/snortd.rules) and don't
find any occurrences of "152087" or "69943".

Beginning of the output of u2spewfoo on the log file:

(Event)
        sensor id: 0    event id: 1     event second: 1517940080
event microsecond: 56660
        sig id: 16      gen id: 129     revision: 1 classification: 3
        priority: 2     ip source: 34.215.60.2  ip destination:
192.168.254.2
        src port: 80    dest port: 33804        protocol: 6 impact_flag:
32 blocked: 1

Packet
        sensor id: 0    event id: 1     event second: 1517940080
        packet second: 1517940080       packet microsecond: 56660
        linktype: 1     packet_length: 60
[    0] B0 7F B9 1A 2E FF 00 26 91 56 78 0B 08 00 45 00 .......&.Vx...E.
[   16] 00 28 A2 9D 40 00 EA 06 D0 AD 22 D7 3C 02 C0 A8 .(..@.....".<...
[   32] FE 02 00 50 84 0C 46 4E FA 61 00 74 2D 65 50 11 ...P..FN.a.t-eP.
[   48] 75 40 2A 29 00 00 00 00 00 00 00 00 u@*)........

(Event)
        sensor id: 0    event id: 2     event second: 1517963742
event microsecond: 913508
        sig id: 4       gen id: 120     revision: 1 classification: 2
        priority: 3     ip source: 72.21.81.240 ip destination:
192.168.254.2
        src port: 80    dest port: 53900        protocol: 6 impact_flag:
32 blocked: 1

Packet
        sensor id: 0    event id: 2     event second: 1517963742
        packet second: 1517963742       packet microsecond: 913508
        linktype: 1     packet_length: 1514
[    0] B0 7F B9 1A 2E FF 00 26 91 56 78 0B 08 00 45 00 .......&.Vx...E.
[   16] 05 DC E7 49 40 00 36 06 FF 21 48 15 51 F0 C0 A8 ...I@.6..!H.Q...
[   32] FE 02 00 50 D2 8C 7E 5D AB 65 4F 71 60 93 50 10 ...P..~].eOq`.P.
[   48] 01 22 13 19 00 00 48 54 54 50 2F 31 2E 31 20 32 ."....HTTP/1.1 2
[   64] 30 30 20 4F 4B 0D 0A 41 63 63 65 70 74 2D 52 61  00 OK..Accept-Ra
[   80] 6E 67 65 73 3A 20 62 79 74 65 73 0D 0A 43 61 63  nges: bytes..Cac
[   96] 68 65 2D 43 6F 6E 74 72 6F 6C 3A 20 70 75 62 6C he-Control: publ
[  112] 69 63 2C 6D 61 78 2D 61 67 65 3D 31 37 32 38 30 ic,max-age=17280
[  128] 30 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 0..Content-Type:
[  144] 20 74 65 78 74 2F 70 6C 61 69 6E 0D 0A 44 61 74 text/plain..Dat
[  160] 65 3A 20 57 65 64 2C 20 30 37 20 46 65 62 20 32  e: Wed, 07 Feb 2
[  176] 30 31 38 20 30 30 3A 33 35 3A 34 32 20 47 4D 54  018 00:35:42 GMT
[  192] 0D 0A 45 74 61 67 3A 20 22 38 30 34 33 35 31 35  ..Etag: "8043515
[  208] 32 38 38 62 30 63 63 31 3A 30 22 0D 0A 4C 61 73 288b0cc1:0"..Las
[  224] 74 2D 4D 6F 64 69 66 69 65 64 3A 20 46 72 69 2C t-Modified: Fri,
[  240] 20 30 32 20 44 65 63 20 32 30 31 31 20 30 30 3A   02 Dec 2011 00:
[  256] 32 31 3A 32 33 20 47 4D 54 0D 0A 53 65 72 76 65  21:23 GMT..Serve


Thanks for any help,

Jim


_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest
Snort news!

Please follow these rules: https://snort.org/faq/what-is-
the-mailing-list-etiquette


_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
Previous By Date Next
Previous By Thread Next

Current thread: