Snort mailing list archives
RE: Snort upgrade/MySQL database problems
From: "Hutchinson, Andrew" <andrew.hutchinson () Vanderbilt Edu>
Date: Mon, 7 Jul 2003 13:06:36 -0500
Hmm. If you upgraded your schema during the 1.8 -> 1.9 move, you should be running the 106 schema, which should have the last_cid entry in the sensors table. Can you run a "select * from schema" to make sure that you're running 106. If you are, then run a "desc sensor" and see if it includes the last_cid field. If it does not, then run: ALTER TABLE sensor ADD last_cid INT UNSIGNED NOT NULL That should add that column with the correct datatype. I'd still be somewhat curious why it isn't there if the schema table says it's 106, though... Andrew Andrew Hutchinson - Network Security Vanderbilt University Medical Center (615) 936-2856
-----Original Message----- From: Marc Quibell [mailto:mquibell () fbfs com] Sent: Monday, July 07, 2003 10:21 AM To: snort-users () sourceforge net Subject: [Snort-users] Snort upgrade/MySQL database problems I have two sensors installed. I just upgraded the OTHER sensor to Snort 2.0. I previously upgrade a current system to 2.0 a month or so ago. Now I am combining the two into the 1.9 MySQL database. I upgraded the schema during my 1.8 > 1.9 migration. Now when I bring my old Snort 2.0 in with the new onto the MySQL database, i get the error: Jul 1 10:03:41 Security snort: database: mysql_error: Unknown column 'last_cid' in 'field list' SQL=INSERT INTO sensor (hostname, interface, detail, encoding, last_cid) VALUES ('Internal','eth1','1','0', '0') Jul 1 10:03:41 Security snort: database: Problem obtaining SENSOR ID (sid) from snortmasterdatabase->sensor Jul 1 10:03:41 Security snort: FATAL ERROR: When this plugin starts, a SELECT query is run to find the sensor id for the currently running sensor. If the sensor id is not found, the plugin will run an INSERT query to insert the proper data and generate a new sensor id. Then a SELECT query is run to get the newly allocated sensor id. If that fails then this error message is generated. Some possible causes for this error are: * the user does not have proper INSERT or SELECT privileges * the sensor table does not exist If you are _absolutely_ certain that you have the proper privileges set and that your database structure is built properly please let me know if you continue to get this error. You can contact me at (roman () danyliw com). I checked and rechecked db rights on the new system, the user has full rights to the database. I've checked many resources, including snort discussions, to no avail. The only thing I've found on this was an older bug. TIA! ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_06 1203_01/01 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort upgrade/MySQL database problems Marc Quibell (Jul 01)
- <Possible follow-ups>
- Snort upgrade/MySQL database problems Marc Quibell (Jul 07)
- RE: Snort upgrade/MySQL database problems Hutchinson, Andrew (Jul 07)