Snort mailing list archives
RE: No Alerts Being Generated
From: "Shawn Kottke" <skottke () datalink com>
Date: Thu, 30 Sep 2004 10:30:27 -0500
Is your mysql snort database increasing in size? (check in /usr/local/mysql/data for a standard install) If you run "snort -c /etc/snort/snort.conf -v" do you see snort detecting anything? Is your acid configured correctly to link to the mysql database? Have you rechecked the documentation that you used to set everything up to make sure you did not miss a step? Just a few thoughts. Shawn -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Matthew K. Lee Sent: Thursday, September 30, 2004 10:03 AM To: snort-users () lists sourceforge net Subject: RE: [Snort-users] No Alerts Being Generated Andrew, Everything looks good. I know that I had a glitch because my snort password had special characters (i.e. #,$,etc.). Once I changed the password, things took off. I'm out of suggestions. Thanks, Matthew Lee -----Original Message----- From: Kaplan, Andrew H. [mailto:AHKAPLAN () PARTNERS ORG] Sent: Thursday, September 30, 2004 9:52 AM To: Matthew K. Lee Cc: Snort User Group (E-mail) Subject: RE: [Snort-users] No Alerts Being Generated Hi Matthew -- Thank-you for your reply, and here are the answers to your questions: 1. The owner/group permissions for /etc/snort are as follows: drwxr-xr-x root root snort/ <- printout 2. I tried a portscan via NeWT and nothing appeared. 3. When I run the mysql command you mentioned in your e-mail, I am able to access the database via the mysql prompt. -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net]On Behalf Of Matthew K. Lee Sent: Wednesday, September 29, 2004 3:47 PM To: snort-users () lists sourceforge net Subject: RE: [Snort-users] No Alerts Being Generated Andrew, 1. What are the owner/group permissions of /etc/snort? 2. Have you tried to send it traffic that would trigger a rule? 3. What happens when you do a 'mysql -u snort -p' with snort's password? Matthew Lee http://www.rycan.com -----Original Message----- From: Kaplan, Andrew H. [mailto:AHKAPLAN () PARTNERS ORG] Sent: Wednesday, September 29, 2004 2:35 PM To: Snort User Group (E-mail) Subject: [Snort-users] No Alerts Being Generated I completed installing snort 2.2.0 (build 30) and have begun running it. The ACID GUI and /var/log/snort/alert files have not shown any alerts even though the program has been running for over an hour. To verify there were no syntax errors in the snort.conf file, I ran the following: snort -c /etc/snort/snort.conf There were no errors and warnings, and the program appears to be running properly. Where in snort.conf and elsewhere, should I check for configuration mistakes? I have included the snort.conf file here. Thanks. <<snort.conf.29sept04.txt>> ------------------------------------------------------- This SF.net email is sponsored by: IT Product Guide on ITManagersJournal Use IT products in your business? Tell us what you think of them. Give us Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more http://productguide.itmanagersjournal.com/guidepromo.tmpl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- This SF.net email is sponsored by: IT Product Guide on ITManagersJournal Use IT products in your business? Tell us what you think of them. Give us Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more http://productguide.itmanagersjournal.com/guidepromo.tmpl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=ort-users ------------------------------------------------------- This SF.net email is sponsored by: IT Product Guide on ITManagersJournal Use IT products in your business? Tell us what you think of them. Give us Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more http://productguide.itmanagersjournal.com/guidepromo.tmpl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- RE: No Alerts Being Generated Matthew K. Lee (Sep 29)
- <Possible follow-ups>
- No Alerts Being Generated Kaplan, Andrew H. (Sep 29)
- Re: No Alerts Being Generated Nigel Houghton (Sep 29)
- RE: No Alerts Being Generated Kaplan, Andrew H. (Sep 30)
- RE: No Alerts Being Generated Matthew K. Lee (Sep 30)
- RE: No Alerts Being Generated Shawn Kottke (Sep 30)