Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Barnyard2 exits if it can't connect to remote syslog

    Scheduled Pinned Locked Moved IDS/IPS
    3 Posts 2 Posters 958 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      muppetpuppet
      last edited by

      Hi,
      Currently running pfsense 2.1.4-RELEASE (amd64) and Snort 2.9.7.0 pkg v3.2.2

      I've set up my snort logs, via barnyard2 to go to a remote syslog. I have tested (sample size of 1, but after barnyard shut itself off a couple of times) that if barnyard2 can not reach the remote syslog server, it shuts itself down (which is fine, I guess). When I tested it, barnyard2 shuts itself off after 5 mins (or so) and displays the error:

      Aug 5 23:17:10 ip-172-16-1-1 barnyard2[64718]: Barnyard2 exiting
      Aug 5 23:17:10 ip-171-16-1-1 barnyard2[64718]: FATAL ERROR: NetSend(): call failed for host:port '172.16.1.2:514' bailing…

      So my questions are:
      Can one confirm this is normal behaviour?
      Is there a way I can set this up so that barnyard2 auto restarts after exiting (can hack a cron script if I have to) or get Barnyard2 to continue to try and send log entries to the remote host without exiting?

      Thanks for your time,
      MuppetPuppet

      1 Reply Last reply Reply Quote 0
      • bmeeksB
        bmeeks
        last edited by

        Unfortunately not much can be done here.  This in an internal function/feature of Barnyard2 itself.  All the Snort package does is just launch the BY2 binary and feed it a configuration file.  After that the BY2 binary does its own thing…

        Best solution would be to see about making the remote syslog server more reliable (or reachable).

        Bill

        1 Reply Last reply Reply Quote 0
        • M
          muppetpuppet
          last edited by

          Thanks Bill, much appreciated.

          I've switched it to UDP and added in further monitoring to ensure I get alerted when the logging stops for a period of time.

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.