Snort mailing list archives
RE: Snort-MySQL problem
From: "Shawn Truax" <Shawn.Truax () mbs gov on ca>
Date: Sat, 11 Oct 2003 19:21:57 -0400
From your previous emails I got the impression that your database is working but snort is not loading your conf file.
Make sure your conf file is located in this directory /etc/snort/ and is called "snort.conf" Your previous snort.conf posting showed you using the output plug in for database and the line seems ok. Mine looks like this if you want to compare: output database: alert, mysql, user=snort password=XXXXXXX dbname=snort host=xxx.xxx.xxx.xxx port=3306 sensor_name="name" detail=full Shawn
"Syed Zuhdi Syed Salim" <syzuhdi () penawargroup com> 10/07/03 10:05pm >>>
This is my /etc/init.d/snortd How to make it log into database ? #!/bin/sh # # Init file for Snort - An Open Source network intrusion detection system. # # Written by Dag Wieers <dag () wieers com>. # # chkconfig: 2345 40 60 # description: snort is a lightweight network intrusion detection system \ # that currently detects more than 1100 host and network \ # vulnerabilities, portscans, backdoors, and more. # # processname: snort # config: /etc/sysconfig/snort # config: /etc/snort/snort.conf # pidfile: /var/lock/subsys/snort.pid source /etc/rc.d/init.d/functions source /etc/sysconfig/network ### Check that networking is up. [ "${NETWORKING}" == "no" ] && exit 0 [ -x /usr/sbin/snort ] || exit 1 [ -r /etc/snort/snort.conf ] || exit 1 [ -r /etc/sysconfig/snort ] || exit 1 ### Default variables SYSCONFIG="/etc/sysconfig/snort" OPTIONS="-s -d" INTERFACE="eth0" USER="snort" ### Read configuration [ -r "$SYSCONFIG" ] && source "$SYSCONFIG" RETVAL=0 prog="snort" desc="Intrusion Detection System" start() { echo -n $"Starting $desc ($prog): " cd /var/log/snort daemon $prog -u $USER -g $USER -D \ -i $INTERFACE -l /var/log/snort -c /etc/snort/snort.conf $OPTIONS RETVAL=$? echo [ $RETVAL -eq 0 ] && touch /var/lock/subsys/$prog return $RETVAL } stop() { echo -n $"Shutting down $desc ($prog): " killproc $prog RETVAL=$? echo [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/$prog return $RETVAL } restart() { stop start } case "$1" in start) start ;; stop) stop ;; restart) restart ;; reload) echo -n $"Reloading $prog: " killproc $prog -HUP RETVAL=$? echo ;; condrestart) [ -e /var/lock/subsys/$prog ] && restart RETVAL=$? ;; status) status $prog RETVAL=$? ;; dump) echo -n $"Dumping $prog database to syslog: " killproc $prog -USR1 RETVAL=$? echo ;; *) echo $"Usage: $0 {start|stop|restart|reload|condrestart|status|dump}" RETVAL=1 esac exit $RETVAL Quoting Shawn Truax <Shawn.Truax () mbs gov on ca>:
Yes the snort.conf is read only once when Snort is initially loaded. If your snort is set to run when the server is first turned on or after a reboot and it doesn't load your custom snort.conf file. Check in the /etc/init.d/ folder for a file with the name of snort in it. This is the area where all the start scripts are located. Make a backup of the file (if there is one) and then edit the original and see if there is a line in it that specifies the snort.conf to load. You may have to do some poking around in this file or post it here for some help. If you don't have a file in the folder for snort then I am not sure how snort is loading automatically. If I have read wrong and want your snort to run auto on reboot then you need to create a file with your snort start up line in it and link it to your run levels. This is another area I am a little weak on and would be best for you to read some or get some help from someone a little more knowledgeable in this area. Best advice is to backup any file you are going to play with. Shawn<CMartin () infosol com> 10/02/03 10:12am >>>It is my understanding that the snort.conf file is only read when the program loads. The snort.conf file basically tells the program how to configure itself when it is loaded into memory. Such as whether to log to the database or to a certain file type, as well as what processors to use. This file is read once and not referred to again while snort is running. Chris P.s. If anyone knows if I'm wrong in making this assumption about snort.conf please let me know :) I don't fear mistakes, but embrace them :P -----Original Message----- From: Syed Zuhdi Syed Salim [mailto:syzuhdi () penawargroup com] Sent: Wednesday, October 01, 2003 6:37 PM To: CMartin () infosol com Subject: RE: [Snort-users] Snort-MySQL problem It's work !!! Another question from me: My Snort is automatic running,but why it doesn't read snort.conf file? Quoting CMartin () infosol com:It would appear that you are running snort in Test mode. I noticed youusedthe -T option in the command line. This tells snort to test the configfileand then exit. So just remove the -T and you will be all set. Chris -----Original Message----- From: Syed Zuhdi Syed Salim [mailto:syzuhdi () penawargroup com] Sent: Tuesday, September 30, 2003 7:31 PM To: snort-users () lists sourceforge net Subject: [Snort-users] Snort-MySQL problem Hi, Snort doesn't log into MySQL database. How to solve this problem??? This the output when I running command : [root@medinetserver bin]# snort -c /etc/snort/snort.conf -i eth0 -T Running in IDS mode Log directory = /var/log/snort Initializing Network Interface eth0 --== Initializing Snort ==-- Initializing Output Plugins! Decoding Ethernet on interface eth0 Initializing Preprocessors! Initializing Plug-ins! Parsing Rules file /etc/snort/snort.conf +++++++++++++++++++++++++++++++++++++++++++++++++++ Initializing rule chains... No arguments to frag2 directive, setting defaults to: Fragment timeout: 60 seconds Fragment memory cap: 4194304 bytes Fragment min_ttl: 0 Fragment ttl_limit: 5 Fragment Problems: 0 Self preservation threshold: 500 Self preservation period: 90 Suspend threshold: 1000 Suspend period: 30 Stream4 config: Stateful inspection: ACTIVE Session statistics: INACTIVE Session timeout: 30 seconds Session memory cap: 8388608 bytes State alerts: INACTIVE Evasion alerts: INACTIVE Scan alerts: ACTIVE Log Flushed Streams: INACTIVE MinTTL: 1 TTL Limit: 5 Async Link: 0 State Protection: 0 Self preservation threshold: 50 Self preservation period: 90 Suspend threshold: 200 Suspend period: 30 Stream4_reassemble config: Server reassembly: INACTIVE Client reassembly: ACTIVE Reassembler alerts: ACTIVE Ports: 21 23 25 53 80 110 111 143 513 1433 Emergency Ports: 21 23 25 53 80 110 111 143 513 1433 http_decode arguments: Unicode decoding IIS alternate Unicode decoding IIS double encoding vuln Flip backslash to slash Include additional whitespace separators Ports to decode http on: 80 rpc_decode arguments: Ports to decode RPC on: 111 32771 alert_fragments: INACTIVE alert_large_fragments: ACTIVE alert_incomplete: ACTIVE alert_multiple_requests: ACTIVE telnet_decode arguments: Ports to decode telnet on: 21 23 25 119 database: compiled support for ( mysql ) database: configured to use mysql database: user = snort database: password is set database: database name = snort database: host = localhost database: sensor name = 192.168.0.3 database: sensor id = 1 database: schema version = 106 database: using the "log" facility 1454 Snort rules read... 1454 Option Chains linked into 146 Chain Headers 0 Dynamic rules +++++++++++++++++++++++++++++++++++++++++++++++++++ Rule application order: ->activation->dynamic->alert->pass->log --== Initialization Complete ==-- -*> Snort! <*- Version 2.0.1 (Build 88) By Martin Roesch (roesch () sourcefire com, www.snort.org) Snort sucessfully loaded all rules and checked all rule chains! database: Closing connection to database "snort" Snort exiting [root@medinetserver bin]# ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-usersdnAYMPDP ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
dnAYMPDP
Current thread:
- Snort-MySQL problem Syed Zuhdi Syed Salim (Sep 30)
- Re: Snort-MySQL problem Edin Dizdarevic (Oct 01)
- Message not available
- Re: Snort-MySQL problem Edin Dizdarevic (Oct 01)
- Message not available
- Re: Snort-MySQL problem Edin Dizdarevic (Oct 01)
- <Possible follow-ups>
- Re: Snort-MySQL problem Shawn Truax (Oct 01)
- Snort-MySQL problem Syed Zuhdi Syed Salim (Oct 01)
- RE: Snort-MySQL problem CMartin (Oct 01)
- RE: Snort-MySQL problem Syed Zuhdi Syed Salim (Oct 01)
- RE: Snort-MySQL problem CMartin (Oct 02)
- RE: Snort-MySQL problem Shawn Truax (Oct 06)
- RE: Snort-MySQL problem Shawn Truax (Oct 13)