RE: Snort

["Michael Steele" <michaels () silicondefense com>]

Ross,

Be sure to set the correct port option in your output database line for
your MSSQL database. I believe the default is 3306 which is where MySQL
sits, and there is one in your Acid configuration too.

I'm really running short on time and won't be back in until next
Wednesday. Would lover to hear from you on this because I have never set
this configuration up. Our programmer is the one who developed support
in Acid for MSSQL, and has set it up, but I haven't had time to sit down
with him and do it from scratch and write the docs.

-Michael
--
 Michael Steele | System Engineer / Support Technician
 mailto:michaels () silicondefense com
 Silicon Defense: IDS solutions - http://www.silicondefense.com
 Snort: Open Source Network IDS - http://www.snort.org



-----Original Message-----
From: Ross Draper [mailto:ross.draper () musicradio com] 
Sent: Friday, June 21, 2002 8:43 AM
To: michaels () silicondefense com
Subject: Snort



Hi Michael

Sorry to bother you - I appreciate you must be up to your neck in people
pestering you for help

I recently deployed Snort/mySQL/Acid/Apache on a windows 2k box, using
your
documentation (worked perfectly - many thanks!).

Due to the stresses placed on it I have now tried to move the database
and web
server functionality to a seperate windows2000 box running MSSQL and
IIS.  I
have created the Table structure in Snort and went through your
intructions on
running acid with mysql and IIS because I could not find any docs on
deploying
snort with mssql remote logging(and a little bit of ini file fiddling to
get php
to talk to mssql).  Things seem to be almost complete except for one
small but
vitally important problem - the damn thing wont log in!

Acid pops up the following message when trying to view reports:

Warning: MS SQL message: Login failed for user 'snort'. (severity 14) in
c:\snort\adodb\adodb-mssql.inc.php on line 145
Warning: MS SQL: Unable to connect to server: localhost in
c:\snort\adodb\adodb-mssql.inc.php on line 145
Error (p)connecting to DB : snort@localhost
Check the DB connection variables in acid_conf.php
               = $alert_dbname   : MySQL database name where the alerts
are
stored
               = $alert_host     : host where the database is stored
               = $alert_port     : port where the database is stored
               = $alert_user     : username into the database
               = $alert_password : password for the username
Database ERROR:Login failed for user 'snort'.

I've reset the passwords, wondered if snort was trying to login with the
user
name of "snort@localhost" so created this login as well as simply
"snort".
Double checked
the ini file and have come to the conclusion that I am simply stupid.

Any ideas?

Kind Regards

Ross




************************************************************************
*
GWR on the Web

http://www.koko.com             http://www.classicfm.com

http://www.corefreshhits.com
http://www.planetrock.com

http://www.opusonline.co.uk                 http://www.gwrgroup.com

CONFIDENTIALITY NOTICE

The information in this e-mail and any attachments to it is confidential
and may be legally privileged or prohibited from disclosure and
unauthorised use. If you are not the intended recipient, any  use,
copying,
disclosure, modification, distribution and/or publication of this 
message or its attachments (if any) is prohibited and may be unlawful.

We will not accept liability for any claims arising as a result
of the use of the internet to transmit information by or to GWR Group
plc.
************************************************************************
*





-------------------------------------------------------
Sponsored by:
ThinkGeek at http://www.ThinkGeek.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users