Snort mailing list archives
Re: Errors with simultaneous outputs in database
From: Muad Dib <bizou31 () yahoo fr>
Date: Fri, 24 Jun 2005 11:03:33 +0200 (CEST)
For those interested, i made a patch for spo_database.c to correct this issue AFAIK, two bugs where presents : 1 - In postgres output, the return value from Select is 0 if there are multiple tuples. Therefore, it inserts in DB each time a 1+ tuple is returned. This bug seems to not be present in the mysql output. For this bug, i only give the select return value to result. 2 - Bug (1) does not resolve the fact that several request can be done simultaneously before the sensor commit. Thus, multiple entries can be inserted the first time an alert is being seen. I corrected this bug by using a delay timer before making a checking Select. This timer is depending from hostname so ********* IT ONLY APPLY TO HOSTNAME = [A-Za-z][0-9]* in regexp ***************** This is the diff file for spo_database.c 55a56
#include <unistd.h>
247a249
char TimeFactor[4]="";
350a353,355
/* Using part of sensorname to generate a
delay_variable */
strcpy(TimeFactor,(char *)escapedSensorName+1);
2249a2255,2256
/* Whatever the result is, we return
the real value and not 0 if it's >1 */
/* If return=0 when result>1 it
inserts many alerts references tuples in DB */ 2253d2259 < result = 0; 2255,2258c2261 < else < { < result = atoi(PQgetvalue(data->p_result,0,0)); < } ---
result =
atoi(PQgetvalue(data->p_result,0,0)); 2267a2271,2285
/* In case no result is received, we
insert a delay depending on hostname to prevent */
/* two snorters or more to insert
simultaneously in database. 100 milliseconds should */
/* be enough to have the first snort
insert and commit before the second doing select */
else { usleep(100000*atoi(TimeFactor)); data->p_result =
PQexec(data->p_connection,query);
if((PQresultStatus(data->p_result) ==
PGRES_TUPLES_OK))
{ if(PQntuples(data->p_result)) { result =
atoi(PQgetvalue(data->p_result,0,0));
} } }
___________________________________________________________________________ Appel audio GRATUIT partout dans le monde avec le nouveau Yahoo! Messenger Téléchargez cette version sur http://fr.messenger.yahoo.com ------------------------------------------------------- SF.Net email is sponsored by: Discover Easy Linux Migration Strategies from IBM. Find simple to follow Roadmaps, straightforward articles, informative Webcasts and more! Get everything you need to get up to speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Errors with simultaneous outputs in database Muad Dib (Jun 22)
- <Possible follow-ups>
- Re: Errors with simultaneous outputs in database Muad Dib (Jun 23)
- Re: Errors with simultaneous outputs in database Muad Dib (Jun 24)