Hi, I tried to set up Snort by following the instruction on

However when I try to verify the Barnyard2 configuration by running d:\winids\activators\by2-test , I saw the following error in postgres log file:

2016-06-24 16:21:57 EDT LOG:  statement: SELECT `ref_system_id`, ref_system_name FROM reference_system;
2016-06-24 16:21:57 EDT DEBUG:  reaping dead processes
2016-06-24 16:21:57 EDT DEBUG:  server process (PID 804) exited with exit code 0
2016-06-24 16:21:57 EDT DEBUG:  attempting to remove WAL segments older than log file 000000000000000000000000
2016-06-24 16:21:57 EDT DEBUG:  SlruScanDirectory invoking callback on pg_subtrans/0000
2016-06-24 16:21:57 EDT ERROR:  operator does not exist: ` integer at character 8
2016-06-24 16:21:57 EDT HINT:  No operator matches the given name and argument type(s). You might need to add explicit type casts.
2016-06-24 16:21:57 EDT STATEMENT:  SELECT `ref_system_id`, ref_system_name FROM reference_system;
2016-06-24 16:21:57 EDT DEBUG:  forked new backend, pid=4056 socket=1320
2016-06-24 16:21:57 EDT DEBUG:  postgres child[4056]: starting with (
2016-06-24 16:21:57 EDT DEBUG:      postgres
2016-06-24 16:21:57 EDT DEBUG:  )
2016-06-24 16:21:57 EDT DEBUG:  InitPostgres
2016-06-24 16:21:57 EDT DEBUG:  my backend ID is 3
2016-06-24 16:21:57 EDT DEBUG:  StartTransaction
2016-06-24 16:21:57 EDT DEBUG:  name: unnamed; blockState:       DEFAULT; state: INPROGR, xid/subid/cid: 0/1/0, nestlvl: 1, children:
2016-06-24 16:21:57 EDT DEBUG:  shmem_exit(0): 1 before_shmem_exit callbacks to make

It looks like it's expecting a column called " `ref_system_id` " in the table reference_system, while the column is just "ref_system_id" based on the script in D:\winids\barnyard2\schemas\create_postgres. Can you please advise what could have gone wrong here?

 

Thanks,

Sally

 

 

I completed a fresh install using Server 2008 R2 and when I preform the test for Barnyard2, I get the below:

        --== Initializing Barnyard2 ==--
Initializing Input Plugins!
Initializing Output Plugins!
Parsing config file "d:\winids\barnyard2\etc\barnyard2.conf"

+[ Signature Suppress list ]+
----------------------------
+[No entry in Signature Suppress List]+
----------------------------
+[ Signature Suppress list ]+

WARNING: invalid Reference spec 'url,'. Ignored
WARNING: invalid Reference spec 'url,'. Ignored
WARNING: invalid Reference spec 'url,'. Ignored
WARNING: invalid Reference spec 'url,'. Ignored
WARNING: invalid Reference spec 'url,'. Ignored
WARNING: invalid Reference spec 'url,'. Ignored
WARNING: invalid Reference spec 'url,'. Ignored
WARNING: invalid Reference spec 'url,'. Ignored
Barnyard2 spooler: Event cache size set to [32768]
INFO database: Defaulting Reconnect/Transaction Error limit to 10
INFO database: Defaulting Reconnect sleep time to 5 second
ERROR database: postgresql_error: ERROR:  operator does not exist: ` integer
LINE 1: SELECT `ref_system_id`, ref_system_name FROM reference_syste...
               ^
HINT:  No operator matches the given name and argument type(s). You might need to add explicit type casts.

[CacheSynchronize()]:, SystemCacheSyncronize() call failed.
ERROR: database [DatabaseInitFinalize()]: CacheSynchronize() call failed ...
Fatal Error, Quitting..
Barnyard2 exiting
database: Closing connection to database "snort"

Attached is build 336 and it works. Your existing config file will work. I have a note in the Barnyard2 users group about this problem.

barnyard2-2.1.14-build336.zip

Hi,

The barnyard2-2.1.14-build336.zip works with no issue, thanks.

 

Sally