I am using the latest build of barnyard Version 2.1.11 (Build 317), When I used the batch mode to process the unified2 logs of snort I can see that barnyard2 process it very well, However when I try to process the same via continous mode it fails to recognize the new unified2 log file which snort creates.
Sorry it was my mistake when I ran in the continous mode I added a astric and the file name like -f merged.log.*, I had to open the spooler.c file to figure out. The comments on that file between line 70 to 80 spotted where I was going wrong.
/* Find the next spool file timestamp extension with a value equal to or