Re: Snort and MySQL

[Miikka Hattberg <miikka () miikkah org>]

I might be totally off, but shouldn't you specify the MySQL username in 
the command whe you start snort.
like ' snort -u snort -c /etc/snort/snort.conf '

m.

Robert Spangler wrote:

> Hello,
>
> I seem to be having a problem setting up snort to use MySQL database.
>
> When I run 'snort -c /etc/snort/snort.conf'  I get the following:
>
> ===================================================
> Running in IDS mode
> Log directory = /var/log/snort
>
> Initializing Network Interface eth0
>
>        --== Initializing Snort ==--
> Initializing Output Plugins!
> Decoding Ethernet on interface eth0
> Initializing Preprocessors!
> Initializing Plug-ins!
> Parsing Rules file /etc/snort/snort.conf
>
> +++++++++++++++++++++++++++++++++++++++++++++++++++
> Initializing rule chains...
> database: compiled support for ( MySQL )
> database: configured to use MySQL
> database:          user = snort
> database: database name = snort
> database:          host = localhost
> database:   sensor name = 192.168.1.100
> ERROR: database: MySQL_error: Access denied for user: 'snort@localhost' (Using 
> password: NO)
> Fatal Error, Quitting..
> ===================================================
>
>
> snort.conf has the following entry:
>
> ===================================================
> output database: log, MySQL, user=snort, password=******** dbname=snort 
> host=localhost
> ===================================================
>
>
> MySQL was setup using this line for snort:
>
> ===================================================
> grant INSERT,SELECT on root.* to snort@localhost;
> SET PASSWORD FOR snort@localhost=PASSOWRD('********');
> grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to snort@localhost;
> grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to snort;
> ===================================================
>
> This was a step by step guide I had followed to set this up.  I'm hoping 
> someone might be able to see what I'm missing.  Thnx
>
>  



-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users