barnyard file reading question

["Mark Olbert" <mark () arcabama com>]

I'm having trouble getting barnyard to read files:

[root@sox /home/mark]# barnyard -f /var/log/snort/snort.log.1077507761

-*> Barnyard! <*-

Version 0.1.0 (Build 17)

By Andrew R. Baker (andrewb () snort org)

and Martin Roesch (roesch () sourcefire com, www.snort.org)

Loading Data Processors...

dp_alert loaded

dp_log loaded

dp_stream_stat loaded

Loading Built-in Output Plugins...

Fast Alert plugin initialized

AlertSyslog initialized

Log Dump plugin initialized

LogPcap initialized

AlertCSV initialized

Parsing Config file: /etc/snort/barnyard.conf

WARNING: '/' detected in filename.  Correcting your mistake!!!!

WARNING: spool_dir set to "/var/log/snort"

Barnyard Version 0.1.0 (Build 17) started

Unable to open spool file

Exiting

 

Using a local file name (i.e., leaving off the /var/log/snort) also results
in an "unable to open spool file" error.

I'm sure I'm missing something obvious, but I haven't been able to figure it
out so far.

- Mark

mark () arcabama com