Re: [Snort-users] Empty alert descriptions

[beenph]

On Fri, May 10, 2013 at 12:58 PM, SnortFan <Snor...@yahoo.com> wrote:
> Hi,
Greetings Ed,
> I recently took over a position over seeing a group of snort sensors and they've been having an issue of empty descriptions on some alerts.
> This has been going on since before the last admin.
>
> Just a few rules seem to generate the empty alerts yet a few of the older sensors don't have this issue.
>
> Pulledpork version v0.6.1 is running on a non-sensor and we push the rules and the sid-msg.map files to all sensors from it. It's had snort version 2.9.4.5 GRE (Build 71)
> installed. We have a script that deploys the new rules and sid-msg.map and then restarts the snort and barnyard2 processes on the sensors.
>
> The 4 sensors generating the non-descriptive alerts are running a snort version 2.9.4.5 GRE (Build 71) and barnyard2 version 2.1.11 (Build 318).
>
> The 2 sensors not having issues are running a snort version 2.9.2.3 IPv6 GRE (Build 205) and barnyard2 version 2.1.9 (Build 263).
>
> On all the sensors the sid-msg.map is the same. The gen-msg.map files do differ but both have entries for the alerts that barnyard2 is picking up with no alerts.
>
> Example alerts: Snort Alert [1:16435:0]
> Snort Alert [119:32:0].
>
Where are you seeing those messages?
Which output plugin are you using with barnyard2?
Cheers,
-elz

[Ed Stoner]

Hi Eric,   

       I'm seeing them in Base. We are not using any plugins. If we were running Barnyard2 version 2.1.9 and we updated to 2.1.11 on half of the servers all the while, still using the same database, would that cause any issues? I noticed on the notes for the barnyard 2.1.13 release, that a purge is needed for the sid_reference table. It's strange that this problem doesn't occur on the servers running barnyard 2.1.9.

 

Thanks,

Ed

[beenph]

On Wed, May 15, 2013 at 12:56 PM, Ed Stoner <snor...@gmail.com> wrote:
> Hi Eric,
> I'm seeing them in Base. We are not using any plugins. If we were
> running Barnyard2 version 2.1.9 and we updated to 2.1.11 on half of the
> servers all the while, still using the same database, would that cause any
> issues? I noticed on the notes for the barnyard 2.1.13 release, that a purge
> is needed for the sid_reference table. It's strange that this problem
> doesn't occur on the servers running barnyard 2.1.9.
>
> Thanks,
> Ed
>

I would suggest that you upgrade to 2-1.13 on all instances.

From there you will start from a fresh baseline, there has been a few
fix since 2-1.9 and 11.

Cheers,
-elz

[Ed Stoner]

When moving from the older versions to 2.1.13, is purging the sig_reference table the only modification needed to existing base database?

What would be the symptoms of not purging the sig_reference table? Immediately until I get all the sensors updated.

Thanks,
Ed

Sent from a mobile device.

> --
>
> ---
> You received this message because you are subscribed to a topic in the Google Groups "barnyard2-users" group.
> To unsubscribe from this topic, visit https://groups.google.com/d/topic/barnyard2-users/d4HVLMdhJOc/unsubscribe?hl=en-US.
> To unsubscribe from this group and all its topics, send an email to barnyard2-use...@googlegroups.com.
> For more options, visit https://groups.google.com/groups/opt_out.
>
>

[beenph]

On Wed, May 15, 2013 at 1:47 PM, Ed Stoner <snor...@gmail.com> wrote:
> When moving from the older versions to 2.1.13, is purging the sig_reference table the only modification needed to existing base database?
>
> What would be the symptoms of not purging the sig_reference table? Immediately until I get all the sensors updated.
>

Stop all barnyard2
Update all instances to 2-1.13

purge the sig_reference table.

restart barnyard2.

From there i sugges you follow the thread for 2-1.13 if you encounter
similar issue as
Mark Starner follow the procedure.


The sig_reference table is a display only table and it has no impact
on logging capabilities.

Its imperative tho that when you upgrade binaries that you do not run
in mixed mode, else
you could encounter unknown behavior that is not critical if you can
handle/fix your database
by hand or using proposed fix.

I am personally on the leave and will be back in more or less 10
hours, thus i wont be able to reply
before i get back after this e-mail,

Thanks for understanding.
-elz