Database Events, information not outputed

[DirtyChai]

last 2 weeks I updated snort from version 2.9.4.6 to the new version 2.9.6.2. I have not updated Barnyard2 (2.1.13). Since snort was updated, Barnyard has started throwing these warnings:

WARNING database [Database()]: Called with Event[0x20de3328] Event Type 7acket [0x0], information has not been outputed.
WARNING database [Database()]: Called with Event[0x20de3378] Event Type 7acket [0x0], information has not been outputed.
WARNING database [Database()]: Called with Event[0x20de33c8] Event Type 7acket [0x0], information has not been outputed.
WARNING database [Database()]: Called with Event[0x20de3418] Event Type 7acket [0x0], information has not been outputed.
WARNING database [Database()]: Called with Event[0x20de3468] Event Type 7acket [0x0], information has not been outputed.

Do I need to change something in my config for the new snort version? I tried turning off IPv6, as I read that it can cause issues, but I continued to receive these warning. Any Ideas?

Thank you,

Ron

[binf]

In your snort configuration file you should use output unified2 and not
output alert_unified2 or output log_unified2.
Make the change, stop snort , stop barnyard2 , Delete created unified2
file, delete waldo.restart snort restart by2 it should be fine.

-elz

On Mon, Oct 20, 2014 at 4:42 PM, DirtyChai notifications@github.com wrote:

last 2 weeks I updated snort from version 2.9.4.6 to the new version
2.9.6.2. I have not updated Barnyard2 (2.1.13). Since snort was updated,
Barnyard has started throwing these warnings:

WARNING database [Database()]: Called with Event[0x20de3328] Event Type 7
http://Packet [0x0], information has not been outputed.
WARNING database [Database()]: Called with Event[0x20de3378] Event Type 7
http://Packet [0x0], information has not been outputed.
WARNING database [Database()]: Called with Event[0x20de33c8] Event Type 7
http://Packet [0x0], information has not been outputed.
WARNING database [Database()]: Called with Event[0x20de3418] Event Type 7
http://Packet [0x0], information has not been outputed.
WARNING database [Database()]: Called with Event[0x20de3468] Event Type 7
http://Packet [0x0], information has not been outputed.

Do I need to change something in my config for the new snort version? I
tried turning off IPv6, as I read that it can cause issues, but I continued
to receive these warning. Any Ideas?

Thank you,

Ron

—
Reply to this email directly or view it on GitHub
#122.

[DirtyChai]

Thanks. I thought I might have missed an underscore, but after reviewing my config, it looks correct. Here is the line from my config that you indicated:

output unified2: filename merged.log, limit 128

[BoWozZ]

how to the next development to Barnyard2 (2.1.13) on snort 2.9.7.0 with use openappid

output configuration: snort.log filename, limit 128, appid_event_types

[binf]

appid_event_types are not supported.

On Thu, Oct 23, 2014 at 1:59 PM, BoWozZ notifications@github.com wrote:

how to the next development to Barnyard2 (2.1.13) on snort 2.9.7.0 with
use openappid

output configuration: snort.log filename, limit 128, appid_event_types

—
Reply to this email directly or view it on GitHub
#122 (comment).