Snort mailing list archives
Re: Where's Waldo?
From: Paul Schmehl <pschmehl_lists () tx rr com>
Date: Tue, 09 Oct 2012 22:58:25 -0500
It's a very strange bug. It only exists on your system. We've been using base for as long as it's existed, and our copy has never had that bug. --On October 9, 2012 8:09:54 PM -0700 AllowOverride <allowoverride () gmail com> wrote:
omg,,, thanks but i am fully aware of how to trbsht, sorry, im not going to respond to all that... i think its a bug, been there done that On Tue, 2012-10-09 at 20:46 -0500, Paul Schmehl wrote:--On October 9, 2012 12:08:11 PM -0700 AllowOverride <allowoverride () gmail com> wrote:Step 5: Verify that base can login to the db and read the alertsits working - but when i clear the data tables on base browser gui, no new data is being recorded.OK. Base does nothing more than to display what's in the database. So, if you empty the tables of data and no new data shows up, base is doing its job. The problem lies elsewhere.i noticed that if i restart the services, or restart apache2, it will start displaying again... kinda odd, i would have to restart anything,, wonders if base is really the right solution at this point, or, maybe there is a switch to flick in itIn order to do fruitful troubleshooting, you have to take one step at a time. Restart one service. Does base start displaying alerts again? Then that service is the problem. If you restart several services and base starts displaying alerts again, you have no way of knowing which service is the problem. Your problem sounds like one that used to occur with barnyard2 - lost connections to the database - but it's hard to tell without knowing which service restarts the alerts. Look at the timestamps and sizes on the snort logs. Is it continually logging? When the log files turn over, does the new one grow in size? Paul Schmehl, Senior Infosec Analyst As if it wasn't already obvious, my opinions are my own and not those of my employer. ******************************************* "It is as useless to argue with those who have renounced the use of reason as to administer medication to the dead." Thomas Jefferson "There are some ideas so wrong that only a very intelligent person could believe in them." George Orwell
Paul Schmehl, Senior Infosec Analyst As if it wasn't already obvious, my opinions are my own and not those of my employer. ******************************************* "It is as useless to argue with those who have renounced the use of reason as to administer medication to the dead." Thomas Jefferson "There are some ideas so wrong that only a very intelligent person could believe in them." George Orwell ------------------------------------------------------------------------------ Don't let slow site performance ruin your business. Deploy New Relic APM Deploy New Relic app performance management and know exactly what is happening inside your Ruby, Python, PHP, Java, and .NET app Try New Relic at no cost today and get our sweet Data Nerd shirt too! http://p.sf.net/sfu/newrelic-dev2dev _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Re: Where's Waldo?, (continued)
- Re: Where's Waldo? AllowOverride (Oct 11)
- Re: Where's Waldo? AllowOverride (Oct 11)
- Re: Where's Waldo? Michael Steele (Oct 11)
- Re: Where's Waldo? Castle, Shane (Oct 11)
- Re: Where's Waldo? AllowOverride (Oct 11)
- Re: Where's Waldo? AllowOverride (Oct 11)
- Re: Where's Waldo? Paul Schmehl (Oct 11)
- Re: Where's Waldo? AllowOverride (Oct 12)
- Re: Where's Waldo? Michael Steele (Oct 11)
- Re: Where's Waldo? AllowOverride (Oct 09)
- Re: Where's Waldo? Paul Schmehl (Oct 09)
- Re: Where's Waldo? AllowOverride (Oct 10)
- Re: Where's Waldo? Jason (Oct 10)
- Re: Where's Waldo? AllowOverride (Oct 10)
- Re: Where's Waldo? Joel Esler (Oct 10)
- Re: Where's Waldo? AllowOverride (Oct 10)
- Re: Where's Waldo? Joel Esler (Oct 10)
- Re: Where's Waldo? AllowOverride (Oct 10)
- Re: Where's Waldo? AllowOverride (Oct 10)
- Re: Where's Waldo? AllowOverride (Oct 10)
- Re: Where's Waldo? AllowOverride (Oct 10)