Take the 2-minute tour ×

I am trying to get barnyard2 to take the unified2 output from snort and send a full syslog message to localhost but I cant seem to get it to work:
I am looking for a syslog message with as much information about the snort alert as possible. Something like this: Snort/Barnyard2-1.10 LOG_SYSLOG_FULL Output Logging
My barnyard2.conf looks like this: http://pastebin.com/KzLMQL1L

I lauch barnyard2 with the following command:

barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort/ -f snort_eth2* -w /var/log/snort/waldo

After launching I get the following messages:

WARNING: Ignoring corrupt/truncated waldofile '/var/log/snort/waldo'
Waiting for new spool file

As a result alerts are not read from my /var/log/snort folder. Any ideas where I am messing up?

share|improve this question
add comment


Your Answer



Browse other questions tagged or ask your own question.