Snort mailing list archives
Re: An acid problem.
From: "kinux" <kinux () hknet com>
Date: Sat, 25 Sep 2004 02:45:11 +0800
In snort.conf, i have choose to use mysql.. # database: log to a variety of databases # --------------------------------------- # See the README.database file for more information about configuring # and using this plugin. # output database: log, mysql, user=snort password=123454 dbname=snort host=localhost ----- Original Message ----- From: Gould, Scott To: snort-users () lists sourceforge net Sent: Friday, September 24, 2004 3:32 PM Subject: RE: [Snort-users] An acid problem. My 1st thought would be to check your snort.conf file for the appropriate output plug-in configuration. You need to tell snort to log to your mysql db, via an output db plug-in line in your snort.conf file.. The documentation at snort.org and the snort.conf file give examples of database output logging. This, is however a method that may not be able to keep up with high bandwidth. You may want to consider a flow like this if you have high bandwidth pipes your monitoring: Snort logs to binary log file Barnyard monitors binary log file, and does inserts into mysql db Lots of information about barnyard can be found in the various setup docs available at snort.org, and by searching the archives of this list. My best advice, only being at this for a year or so myself, is to start simple (which your doingJ), get your current setup working, then look to tune performance down the road. Hope this helps. Scott Gould, MCP Senior Network & Systems Analyst Gynecologic Oncology Group Statistical & Data Center sgould () gogstats org 716-845-5702 ------------------------------------------------------------------------------ From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of kinux Sent: Friday, September 24, 2004 2:10 AM To: snort-users () lists sourceforge net Subject: [Snort-users] An acid problem. hi, i installed snort, mysql, acid by ports on a freebsd box. When i try to display Alert Listing: 15 Last Alerts, there is nothing show on the screen. as following. What's the problem? ACID Alert Listing: 15 Last Alerts Home Search | AG Maintenance [ Back ] Added 0 alert(s) to the Alert cache Queried DB on : Fri September 24, 2004 10:22:20 Meta Criteria any IP Criteria any Layer 4 Criteria none Payload Criteria any Displaying 15 Last Alerts Thanks.
Current thread:
- An acid problem. kinux (Sep 23)
- <Possible follow-ups>
- RE: An acid problem. Gould, Scott (Sep 24)
- Re: An acid problem. kinux (Sep 24)