snort me esta recopilando informacion en /var/log/snort/
10/15-02:12:47.942347 [**] [1:10000001:0] ”ICMP test” [**] [Priority: 0] {ICMP} 192.168.1.2 -> 192.168.1.10
10/15-02:12:48.191046 [**] [1:10000001:0] ”ICMP test” [**] [Priority: 0] {ICMP} 192.168.1.2 -> 82.98.134.26
10/15-02:12:48.241427 [**] [1:10000001:0] ”ICMP test” [**] [Priority: 0] {ICMP} 82.98.134.26 -> 192.168.1.2
-rwxrwxrwx 1 snort snort 0 oct 13 07:56 alert
drwxr-xr-x 3 root root 4096 oct 14 19:14 eth0
-rw------- 1 root root 0 oct 14 18:17 merged.log
-rw------- 1 snort snort 0 oct 13 10:20 snort.alert
-rw------- 1 snort snort 6 oct 14 19:38 snort_eth0.pid
-rw------- 1 snort snort 0 oct 15 02:07 snort_eth0.pid.lck
-rw------- 1 snort snort 0 oct 13 10:20 snort.log
-rw------- 1 snort snort 0 oct 13 09:30 snort.log.1444721411
-rw------- 1 snort snort 0 oct 13 09:40 snort.log.1444722026
-rw------- 1 snort snort 0 oct 13 09:47 snort.log.1444722446
-rw------- 1 root root 0 oct 14 17:40 snort.log.1444837254
-rw------- 1 snort snort 0 oct 14 19:21 snort.log.1444843300
-rw------- 1 snort snort 0 oct 14 19:26 snort.log.1444843568
-rw------- 1 snort snort 0 oct 14 19:38 snort.log.1444844323
-rw------- 1 snort snort 0 oct 14 19:57 snort.log.1444845468
-rw------- 1 snort snort 221608 oct 15 02:07 snort.log.1444867186
en /etc/snort/snort.conf
output unified2: filename merged.log, limit 128, nostamp, mpls_event_types, vlan_event_types
en /etc/snort/barnyard2.conf
config hostname: localhost
config interface: eth0
# config alert_with_interface_name
......
# this is not hard, only unified2 is supported ;)
input unified2
.......
# Examples:
output database: log, mysql, user=snort password=hacker007 dbname=dbsnort host=localhost
# output database: alert, postgresql, user=snort dbname=snort
# output database: log, odbc, user=snort dbname=snort
# output database: log, mssql, dbname=snort user=snort password=test
# output database: log, oracle, dbname=snort user=snort password=test
root@debian-2:/var/log/barnyard2# ls -la
total 8
drwxr-xr-x 2 snort snort 4096 oct 13 02:35 .
drwxr-xr-x 22 root root 4096 oct 15 07:35 ..
root@debian-2:/var/log/barnyard2#
que pasa con barnyard2 no me muestra en base los eventos que genera snort? algun experto por aqui en ids