Re: [Snort-devel] Snort logging to Oracle

[Joe McAlerney <joey () SiliconDefense com>]

Jim could probably answer this better then me, but it is an issue with
SPADE and Oracle.  One way around is to do the following:

1) remove the "inline" function types from those lines
2) change "min" and "max" to something like "smin" and "smax".  Oracle
must be using min and max somewhere too.  I haven't had the chance to
debug this one fully.
3) On line 322 of spp_anomsensor.h, replace "min" and "max" with "smin"
and "smax" respectively.
4) recompile

As far as your issue with missing files on the Oracle sensor, yes we
have had the same experience and did exactly what you did.

-Joe M.

-- 
|   Joe McAlerney     joey () silicondefense com   |
| Silicon Defense - Technical Support for Snort |
|       http://www.silicondefense.com/          |
+--                                           --+

Vitaly Osipov wrote:
> Hi all,
>
> Do I need to install Oracle on sensor host to get snort logging to a remote
> database? I hope that not... I took some header files from oracle-linux
> 8.0.7,  snort 1.8 compiles without complaining on header files missing, but
> there is a weird error -
>
> gcc -DHAVE_CONFIG_H -I. -I. -I. -I/usr/include/pcap  -I/usr/include/mysql -D
> ENABLE_MYSQL -I/usr/local/rdbms/demo -I/usr/local/rdbms/public -I/usr/local/
> network/public -DENABLE_ORACLE  -g -O2 -Wall -c spp_anomsensor.c
> spp_anomsensor.c:1781: parse error before `int'
> spp_anomsensor.c:1785: parse error before `int'
> make: *** [spp_anomsensor.o] Error 1
>
> (today's CVS snapshot)
>
> snort is configured --with-oracle --without-openssl --without-postgresql
> (--with-openssl also gives a strange error, but i'm more interested in
> oracle than  in openssl).
>
> if i omit --with-oracle, everything compiles perfectly... do I miss
> something?
>
> regards,
> Vitaly.
>
> _______________________________________________
> Snort-devel mailing list
> Snort-devel () lists sourceforge net
> http://lists.sourceforge.net/lists/listinfo/snort-devel

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users