![snort logo](/images/snort-logo.png)
Snort mailing list archives
ACID Archive problems
From: "Slighter, Tim" <tslighter () itc nrcs usda gov>
Date: Thu, 25 Jul 2002 14:41:11 -0600
What is being used: Redhat 7.2 system with most everything on it. Involved components: PHP 4.06 MySQL 2.20 Apache 1.3.20 OpenSSL 0.9.6b Acid 0.9.6b13 Schema 105 Have successfully setup both the ACID and ARCHIVE database via mySQL and have ran the create_mysql script and then gave the appropriate users the necessary permissions (CREATE, INSERT, SELECT, DELETE, UPDATE) using grant to the archive database. Also have configured the acid_conf.php file to input the correct entries for the user, password and db for ACID and ARCHIVE. I manually tested this out by creating an event ID and then manually deleting it and this worked correctly..so permissions DO work and therefore this possibility can be ruled out. However, when running the web front-end for ACID in the "ADMIN" mode, when I attempt to "move" events to the archive, it will move just 3 of the same alerts or any number of different alerts and then will no longer move any more events and will generate an error about "duplicate events ignored" and "0 events moved - ARCHIVE-MOVE failed or was not successful". As I mentioned above, after verifying the correct user and password and database are specified in the acid_conf.php file in the ACID directory as well as the ARCHIVE directory and manually testing out the DELETE, INSERT and UPDATE permission for the specified USER on the specified DATABASE, and have determined that all of these DO function. So to be very specific about this problem: Can select "3" of the same events such as SCAN SOCKS Proxy attempt and can successfully "Archive Alerts - MOVE" and this can be verified by connecting to the archive database and the moved alerts are there. HOWEVER, if I attempt to move even 1 more of the same type of alert, the move fails and this error appears: Added 0 alert to the Alert cache Ignored 1 duplicate alert(s) No alerts were selected or the ARCHIVE-move was not successful PLEASE note that performing the Archive Alerts - Move with a "different alert" such as "SCAN Aquid Proxy attempt" does work correctly up until there are exactly "3" of these alerts in the archive database and then the archive for these alerts no longer works. Why does the move or copy archive bomb out when detecting duplicate events ?
Current thread:
- ACID Archive problems Slighter, Tim (Jul 25)