Barnyard2 – Dedicated Spooler for Snort Output
Barnyard2 is an open source dedicated spooler for Snort output as unified2 binary output files. Its primary use is allowing Snort to write to disk in an efficient manner and leaving the task of parsing binary data into various formats to a separate process that will not cause Snort to miss network traffic. How it Works Barnyard2 has 3 modes of operation: batch (or one-shot), continual, and continual w/ bookmark. In batch (or one-shot) mode, barnyard2 will process the explicitly specified file(s) and exit. In continual mode, barnyard2 will start with a location to look and a specified file pattern and continue to process new data (and new spool files) as they appear. Continual mode w/ bookmarking will also use a checkpoint file (or waldo file in the snort world) to track where it is. In the event, the barnyard2 process ends while a waldo file is in use, barnyard2 will resume processing at the last entry as listed in the waldo file. Barnyard2 processing is controlled by two main types of...