crice01

OK, that got me working! I had: 'output unified2: filename merged.log, limit 128 #, nostamp, mpls_event_types, vlan_event_types' in my snort configuration. Removing the '#, nostamp, mpls_event_types, vlan_event_types' portion has made everything much happier. Thanks for your help.

Install went OK, but all I get from barnyard2 is: WARNING: Can't extract timestamp from 'merged.log' using base 'merged.log' Any ideas how to correct this issue?