Re: MYSQL Error

[Paul Schmehl <pauls () utdallas edu>]

--On Friday, December 19, 2003 16:50:07 -0700 Dan Ferris <dferris () maad com> 
wrote:

> Has anyone found the cause of this type of problem yet:
>
> Dec 19 16:42:49 napoleon snort: database: mysql_error: Duplicate entry
> '1-48' for key 1 SQL=INSERT INTO event (sid,cid,signature,timestamp)
> VALUES ('1', '48', '9', '2003-12-19 16:42:49-07')
At the risk of sounding trite, it's caused by duplicate processes trying to 
write to the database.  For example, you've started snort twice, so you 
have two processes running with the same snort.conf file and startup 
parameters.  Or you haven't specified the sensor_name in your output plugin 
configuration, you have two copies of snort running and it's defaulting to 
the same sensor_name for both processes.

In short, two things are trying to write the same *identical* information 
to the database.

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu


-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users