Re: [Sguil-users] A Barnyard Problem

[Falcon S. <streetwf@UFL.EDU>]

Thanks for the reply.  I forgot to mention that I patched it for x64.
I'm still no sure if it is only for when you use certain versions of
snort???  Either way, I tried it with AND without the patch.  Same
results both ways.  I'll try again just in case:-).

Thanks, though.


On Wed, 2007-09-05 at 11:56 -0400, Jeff Lake wrote:
> Falcon Street wrote:
> > Hey all, maybe someone here can help me out.
> > 
> > I had a snort/barnyard/sguil setup that worked fine, but I then needed
> > to do some necessary hardware and software upgrading. In the process,
> > I've run into a problem with barnyard.
> > 
> > My issue is that barnyard is giving me the infamous, "Invalid packet
> > length:#########" error. No matter what I do, if snort is running, I get
> > that error from barnyard, and it then exits. I know about the snort
> > unified output bug, but when I remove the logs and waldo file and
> > restart, I still get the error.
> > 
> > 
> > I'm running Ubuntu 6.06 LTS x64. (Previously, the OS was the same, just
> > 32bit.) 
> > 
> > I have everything running properly so far, except for PADS and, of
> > course, barnyard (thus I can't get any events in sguil). 
> 
> I believe you have to patch barnyard to make it run on x64. Try here:
> 
> http://secure.lv/~nikns/stuff/barnyard_64bit.diff
> 
> J
> 
> 
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems?  Stop.
> Now Search log events and configuration files using AJAX and a browser.
> Download your FREE copy of Splunk now >>  http://get.splunk.com/
> _______________________________________________ Sguil-users mailing list Sgu...@li... https://lists.sourceforge.net/lists/listinfo/sguil-users