Re: Snort, Barnyard, MySQL problem

["Jefferson, Shawn" <Shawn.Jefferson () bcferries com>]

Hi,

Yes, thank you, that's exactly what the problem was!  I added the line below to my startup script (without the 
semi-colon after the
do) and watched as I rebooted it, and sure enough #2 could not ping #1 until 20-30 seconds after boot.  Putting the 
wait loop in the
script solved my problem!

It may be exacerbated by having these systems on DHCP right now while they are in test... I'll be statically assigning 
IP addresses
later.

Thanks again!
Shawn

-----Original Message-----
From: Paul Schmehl [mailto:pschmehl_lists () tx rr com] 
Sent: November 06, 2008 2:10 PM
To: Jefferson, Shawn; snort-users () lists sourceforge net
Subject: Re: [Snort-users] Snort, Barnyard, MySQL problem

No, you were perfectly clear.  I just wasn't reading carefully enough.

It may still be a timing issue.  Is the network up and running on #2 before 
barnyard tries to connect to #1?  Have you tried sniffing the interface with 
wireshark to see what's going on?  Or tcpdump?

You may have to put a sleep routine in the barnyard init script until #1 
responds to pings.  Something like "until ping -qc 5 #1; do; echo whatever; 
done"

--On Thursday, November 06, 2008 15:15:01 -0600 "Jefferson, Shawn" 
<Shawn.Jefferson () bcferries com> wrote:

> Hi,
>
> Sorry, I may not have been clear.  MySQL is running on #1, and Barnyard on #2
> connects to MySQL on #1.  #1 is up and running when #2
> is restarted.
>
> Shawn
>
> -----Original Message-----
> From: Paul Schmehl [mailto:pschmehl_lists () tx rr com]
> Sent: November 06, 2008 1:03 PM
> To: Jefferson, Shawn; snort-users () lists sourceforge net
> Subject: Re: [Snort-users] Snort, Barnyard, MySQL problem
>
> --On Thursday, November 06, 2008 14:26:42 -0600 "Jefferson, Shawn"
> <Shawn.Jefferson () bcferries com> wrote:
>
> > I have two Snort machines, #1 is running MySQL and BASE.  I have a script to
> > startup snort and barnyard on #2 with priority 95, but on startup, barnyard
> > gives me the following error message:
> >
> >
> > Failed to connect to database snort:XXXXXX@172.17.129.150/snort: Can't
> > connect to MySQL server on 172.17.129.150 (101)
> >
> > Fatal Error, Quitting... Exiting.
> >
> > If I SSH into #2 and then run the startup script, barnyard connects properly.
> >
> > Any ideas on how to get this to work?
>
> Sounds like you have a timing issue.  Mysql has to be completely up and
> running
> and waiting for connections before barnyard can login to it.  Make sure that
> the mysql script has a low enough priority that by the time barnyard starts
> mysql is ready.
>
> --
> Paul Schmehl, Senior Infosec Analyst
> As if it wasn't already obvious, my opinions
> are my own and not those of my employer.
> *******************************************
> Check the headers before clicking on Reply.
>
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
> Build the coolest Linux based applications with Moblin SDK & win great prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



-- 
Paul Schmehl, Senior Infosec Analyst
As if it wasn't already obvious, my opinions
are my own and not those of my employer.
*******************************************
Check the headers before clicking on Reply.


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users