Snort mailing list archives
Re: Snort-MySQL problem
From: "Shawn Truax" <Shawn.Truax () mbs gov on ca>
Date: Wed, 01 Oct 2003 03:15:26 -0400
First make sure that mysql is running and you can log in manually at the command line. (I.E. does the user name and password work.) Next make sure the output plug in has no typos on the password. From your email it looks like you have all this done but I like to double check things. My first suggestion would be to change localhost to 127.0.0.1 in your output plugin. Second make sure the user snort has the proper privileges within mysql. I ran into some issues with this myself and had to do a "set password" for snort@localhost as well as snort@%. There are some documents at snort.org for these steps. If you are still having issues post your output plugin line to the mailing list and I will take a look. Be sure to remove your password other secret stuff first. Shawn
"Syed Zuhdi Syed Salim" <syzuhdi () penawargroup com> 10/01/03 01:40am >>>
Hi, I have problem to log into MySQL database; I have configure snort.conf to use MySQL How to solve this problem ??? This the output when I running this command: [root@medinetserver root]# snort -c /etc/snort/snort.conf -i eth0 -T Running in IDS mode Log directory = /var/log/snort Initializing Network Interface eth0 --== Initializing Snort ==-- Initializing Output Plugins! Decoding Ethernet on interface eth0 Initializing Preprocessors! Initializing Plug-ins! Parsing Rules file /etc/snort/snort.conf +++++++++++++++++++++++++++++++++++++++++++++++++++ Initializing rule chains... No arguments to frag2 directive, setting defaults to: Fragment timeout: 60 seconds Fragment memory cap: 4194304 bytes Fragment min_ttl: 0 Fragment ttl_limit: 5 Fragment Problems: 0 Self preservation threshold: 500 Self preservation period: 90 Suspend threshold: 1000 Suspend period: 30 Stream4 config: Stateful inspection: ACTIVE Session statistics: INACTIVE Session timeout: 30 seconds Session memory cap: 8388608 bytes State alerts: INACTIVE Evasion alerts: INACTIVE Scan alerts: ACTIVE Log Flushed Streams: INACTIVE MinTTL: 1 TTL Limit: 5 Async Link: 0 State Protection: 0 Self preservation threshold: 50 Self preservation period: 90 Suspend threshold: 200 Suspend period: 30 Stream4_reassemble config: Server reassembly: INACTIVE Client reassembly: ACTIVE Reassembler alerts: ACTIVE Ports: 21 23 25 53 80 110 111 143 513 1433 Emergency Ports: 21 23 25 53 80 110 111 143 513 1433 http_decode arguments: Unicode decoding IIS alternate Unicode decoding IIS double encoding vuln Flip backslash to slash Include additional whitespace separators Ports to decode http on: 80 rpc_decode arguments: Ports to decode RPC on: 111 32771 alert_fragments: INACTIVE alert_large_fragments: ACTIVE alert_incomplete: ACTIVE alert_multiple_requests: ACTIVE telnet_decode arguments: Ports to decode telnet on: 21 23 25 119 database: compiled support for ( mysql ) database: configured to use mysql database: user = snort database: password is set database: database name = snort database: host = localhost database: sensor name = 192.168.0.3 database: sensor id = 1 database: schema version = 106 database: using the "log" facility 1454 Snort rules read... 1454 Option Chains linked into 146 Chain Headers 0 Dynamic rules +++++++++++++++++++++++++++++++++++++++++++++++++++ Rule application order: ->activation->dynamic->alert->pass->log --== Initialization Complete ==-- -*> Snort! <*- Version 2.0.1 (Build 88) By Martin Roesch (roesch () sourcefire com, www.snort.org) Snort sucessfully loaded all rules and checked all rule chains! database: Closing connection to database "snort" Snort exiting [root@medinetserver root]# ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort-MySQL problem Syed Zuhdi Syed Salim (Sep 30)
- Re: Snort-MySQL problem Edin Dizdarevic (Oct 01)
- Message not available
- Re: Snort-MySQL problem Edin Dizdarevic (Oct 01)
- Message not available
- Re: Snort-MySQL problem Edin Dizdarevic (Oct 01)
- <Possible follow-ups>
- Re: Snort-MySQL problem Shawn Truax (Oct 01)
- Snort-MySQL problem Syed Zuhdi Syed Salim (Oct 01)
- RE: Snort-MySQL problem CMartin (Oct 01)
- RE: Snort-MySQL problem Syed Zuhdi Syed Salim (Oct 01)
- RE: Snort-MySQL problem CMartin (Oct 02)
- RE: Snort-MySQL problem Shawn Truax (Oct 06)
- RE: Snort-MySQL problem Shawn Truax (Oct 13)