Snort mailing list archives
RE: Snort 1.9, RH 7.3 and Acid
From: Kevin Brown <Kevin.M.Brown () asu edu>
Date: Mon, 07 Oct 2002 13:13:51 -0700
Did you check your syslogs to see if Snort dumped any messages there? Typically (under linux) they are /var/log/messages -----Original Message----- From: Beckett, Josh Cc: snort-users () lists sourceforge net Sent: 10/4/02 2:17 PM Subject: RE: [Snort-users] Snort 1.9, RH 7.3 and Acid
From the 'create_mysql' script used to set up the db (as outlined in the
paper) -- ***snip*** #1.17 CREATE TABLE schema ( vseq INT UNSIGNED NOT NULL, ctime DATETIME NOT NULL, PRIMARY KEY (vseq)); INSERT INTO schema (vseq, ctime) VALUES ('106', now()); ***end snip*** Already at 1.06 J- -----Original Message----- From: Addam Schroll [mailto:addam () purdue edu] Sent: Friday, October 04, 2002 2:12 PM To: Beckett, Josh Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] Snort 1.9, RH 7.3 and Acid The Snort database schema was modified about a month ago in the 1.9 branch. The DB inserts may be failing when it attempts to mess with the new last_cid field. Try upgrading your schema to v106. That may solve your problem. The instructions for upgrading follow.
From the Changelog:
2002-09-03 Roman Danyliw <roman () danyliw com> * src/output-plugin/spo_database.c - DB schema v106 - Added the sensor.last_cid field to the schema so the database can store the last used cid for a given sensor. This field will ensure that a cid will never be reused. Upgrading from v105 -> v106 is as simple as: mysql> ALTER TABLE sensor ADD last_cid INT UNSIGNED NOT NULL; mysql> UPDATE schema SET vseq=106; psql> ALTER TABLE sensor ADD last_cid INT8; psql> UPDATE schema SET vseq=106; Addam On Fri, 2002-10-04 at 15:14, Beckett, Josh wrote:
Ok...I was excited by the announcement of 1.9 and went and did a dumb thing...upgraded right on a production box. I did my initial setup using the doc from the snort website "Snort Installation Manual: Snort, MySQL and ACID on RedHat 7.3" (great doc, btw). Every thing went fine relative to the upgrade, etc. Compiled fine, used the new conf file and "current" rules set. Snort seems to be running fine, but doesn't seem to want to log to ACID-MySQL. As a troubleshooting measure, I set "log to file" on as well as log to db, I can see alerts going into a file, but not the db. I've even gone and blown away the db's and re-set them up, using the steps outlined in the paper. Still no joy. I've triple checked the snort.conf file for silly things, like bad rules path, bad db password and user name and everything seems to be fine...still no alerts in the db, but alerts pop up in the file. I've
even checked the configure.log to make sure that I compiled with the --with-mysql switch...good there. Any other places to check, where I might be having a problem? Thanks, Josh ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list
------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort 1.9, RH 7.3 and Acid Beckett, Josh (Oct 04)
- Re: Snort 1.9, RH 7.3 and Acid Addam Schroll (Oct 04)
- <Possible follow-ups>
- RE: Snort 1.9, RH 7.3 and Acid Beckett, Josh (Oct 04)
- RE: Snort 1.9, RH 7.3 and Acid Slighter, Tim (Oct 07)
- RE: Snort 1.9, RH 7.3 and Acid Erek Adams (Oct 07)
- RE: Snort 1.9, RH 7.3 and Acid Beckett, Josh (Oct 07)
- RE: Snort 1.9, RH 7.3 and Acid Kevin Brown (Oct 07)
- RE: Snort 1.9, RH 7.3 and Acid Beckett, Josh (Oct 08)
- RE: Snort 1.9, RH 7.3 and Acid Erek Adams (Oct 08)