|
Hi,
I've a question regarding barnyard (I happen to
call one of my best friends by this name :)
I'm not sure what to do with the
results.
My command line;
barnard -c /usr/local/barnyard/etc/barnyard.conf -d
/var/log/snort -g /usr/local/snort/etc/gen-msg.map -s
/usr/local/snort/etc/sid-msg.map -f snort.alert
I pretty much got this from the barnyard USAGE file
but don't understand the -f option as I expect to see a snort.alert
file.
I do see info in both the gen-msg.map and
sid-msg.map files but am not sure wether I am supposed to filter or tail or cat
these files.
The reason I'd like to use barnyard is
that;
1) I've a gig e network and the manual says that
you may want to use some kind of binary reader in this case for
speed.
2) I'd rather not use the console output as it can
be slow.
3) with barnyard I have the option of picking up
where I left off in the event of a crashed program or system and don't have to
look at the entire output from the begining.
Thanks in advance,
Bri-
|