Re: snort 2.0.1 corrupting tables?

[Bryan Irvine <bryan.irvine () kingcountyjournal com>]

> > Yup I did.  I even tried reverting to a 2.0 version just as a test but
> > that didn't make a difference.
>
> Change the sensor ID.  I'm betting that's what the issue is.

I actually truncated the whole signature table and tried to have it
rebuilt...no dice.  It's not quite productions yet so I dropped the
whole db and rebuilt it, it only does it once in a great while now. 
Like this one

Aug  6 11:54:04 knox3 snort: database: warning (SELECT ref_system_id
FROM reference_system WHERE  ref_system_name = 'arachNIDS') returned
more than one result 
Aug  6 11:54:04 knox3 snort: database: warning (SELECT ref_system_id
FROM reference_system WHERE  ref_system_name = 'arachNIDS') returned
more than one result 
Aug  6 11:54:04 knox3 snort: database: warning (SELECT ref_system_id
FROM reference_system WHERE  ref_system_name = 'arachNIDS') returned
more than one result 
Aug  6 11:54:04 knox3 snort: database: Unable to insert unknown
reference tag ('P\M-|\^]') used in rule. 
Aug  6 11:54:04 knox3 snort: database: Unable to insert unknown
reference tag ('P\M-|\^]') used in rule. 



> [...snip...]
>
> > -D is there. :-/
>
> Cool.  One down.  One to go!  :)

Except it still displays to stdout even with -D.  Odd eh?  the 2 snort
machines are exactly identical.  OpenBSD 3.3 boxes except one is using
intel ethernet cards, the other 3com.  That wouldn't make a difference
would it?  hmmmmm

--Bryan



-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users