Snort mailing list archives
RE: [RGSPAM] RE: Snort Beta v2.6
From: "Ron Jenkins" <rjenkins () dibr net>
Date: Mon, 20 Mar 2006 20:14:04 -0600
I'm sorry to be a pain, but now I am getting the below MySQL errors with v2.6. Version 2.4.4 works fine. database: mysql_error: Unknown column 'sig_gid' in 'where clause' database: mysql_error: Unknown column 'sig_gid' in 'field list' SQL=INSERT INTO signature (sig_name,sig_class_id,sig_priority,sig_rev,sig_sid,sig_gid) VALUES ('MISC MS Terminal server request',1,3,13,1448,1) database: mysql_error: Unknown column 'sig_gid' in 'where clause' database: Problem inserting a new signature 'MISC MS Terminal server request' database: mysql_error: Duplicate entry '0-1' for key 1 SQL=INSERT INTO sig_reference (sig_id, ref_seq, ref_id) VALUES (0, 1, 3) database: mysql_error: Duplicate entry '0-2' for key 1 SQL=INSERT INTO sig_reference (sig_id, ref_seq, ref_id) VALUES (0, 2, 1284) database: mysql_error: Duplicate entry '0-3' for key 1 SQL=INSERT INTO sig_reference (sig_id, ref_seq, ref_id) VALUES (0, 3, 1) database: mysql_error: Duplicate entry '0-4' for key 1 SQL=INSERT INTO sig_reference (sig_id, ref_seq, ref_id) VALUES (0, 4, 2) database: mysql_error: Unknown column 'sig_gid' in 'where clause' database: mysql_error: Unknown column 'sig_gid' in 'field list' SQL=INSERT INTO signature (sig_name,sig_class_id,sig_priority,sig_rev,sig_sid,sig_gid) VALUES ('BLEEDING-EDGE POLICY MSN status change',10,1,2,2002192,1) database: mysql_error: Unknown column 'sig_gid' in 'where clause' database: Problem inserting a new signature 'BLEEDING-EDGE POLICY MSN status change' database: mysql_error: Unknown column 'sig_gid' in 'where clause' database: mysql_error: Unknown column 'sig_gid' in 'field list' SQL=INSERT INTO signature (sig_name,sig_class_id,sig_priority,sig_rev,sig_sid,sig_gid) VALUES ('BLEEDING-EDGE POLICY MSN status change',10,1,2,2002192,1) database: mysql_error: Unknown column 'sig_gid' in 'where clause' database: Problem inserting a new signature 'BLEEDING-EDGE POLICY MSN status change' Thanks... -----Original Message----- From: Jason Brvenik [mailto:jasonb () sourcefire com] Sent: Monday, March 20, 2006 8:02 PM To: Ron Jenkins Cc: snort-users () lists sourceforge net Subject: Re: [RGSPAM] RE: [Snort-users] Snort Beta v2.6 response inline. Ron Jenkins wrote:
I got it to load with the following; thanks Jason:
Good to hear. Happy to help.
/usr/local/bin/snort -e -i eth1 -d -c /etc/snort/snort.conf -l
/var/log/snort --dynamic-preprocessor-lib
/usr/local/lib/snort_dynamicpreprocessor/libsf_ftptelnet_preproc.so
--dynamic-preprocessor-lib
/usr/local/lib/snort_dynamicpreprocessor/libsf_smtp_preproc.so
Does anyone know what these messages refer too?
/Warning: flowbits key 'http.jpeg' is checked but not ever set./
/Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set./
/Warning: flowbits key 'dce.bind.veritas' is set but not ever
checked./
/Warning: flowbits key 'netbios.lsass.bind.attempt' is checked but not
ever set./
/Warning: flowbits key 'dce.isystemactivator.bind.call.attempt' is set
but not ever checked./
/Warning: flowbits key 'trojan' is set but not ever checked./
/Warning: flowbits key 'realplayer.playlist' is checked but not ever
set./
These indicate that some rules set or check flowbits but there are no rules which set or check them. This is normal from time to time as bits are often set for future checks, for rule chains that may be disabled, or for rules that have been moved out. If these are never checked the rules that set them are _usually_ safe to disable as well.
//
/Not Using PCAP_FRAMES/
You are not using a setting that can help with performance. http://www.snort.org/docs/snort_htmanuals/htmanual_2.4/rc1/node27.html
Current thread:
- RE: [RGSPAM] RE: Snort Beta v2.6 Ron Jenkins (Mar 20)
- Re: [RGSPAM] RE: [RGSPAM] RE: Snort Beta v2.6 Jason Brvenik (Mar 20)