RE: Acid Issues with snort

[Roman Danyliw <roman () danyliw com>]

> Yes indeed, still having problems with the graphing and the AG stuff and no
> solutions or feedback.  As for getting the archive thing to work...I had to
> resort to getting the latest PHP (being a while back) the version happens to
> be PHP4-200208211200 with Acid 0.9.6b21 and mySQL 3.23.51.

Upgrade to the just released 0.9.6b22 version of ACID.

> So, by getting these releases, you will most likely be forced to do what I
> did and drop all the exisiting databases and recreate them with the new
> builds.

There are upgrade instructions in the Snort Changelog for converting v104+
DB schema into v106.

> Lots of work unfortunately.  According to rumors, the schema 106 is
> supposed to allow snort to work around the duplicate sid/cid issue when
> integrating with ACID...

The change to DB schema v106 should address the duplicate sid/cid issue.

> perhaps if this is the case...wonder if the older
> versions of ACID might work with new schema ???

ACID v0.9.6b22 works with Snort DB schema v100-106 (i.e., Snort 1.8 and
1.9).

cheers,
Roman


>  -----Original Message-----
> From: Cloppert, Michael [mailto:Michael.Cloppert () 53 com]
> Sent: Friday, September 06, 2002 11:40 AM
> To: 'Slighter, Tim'; 'snort-users () lists sourceforge net'
> Subject: RE: [Snort-users] Acid Issues with snort
>
>
>
> I've seen this graphing behavior and have been bitching about it constantly
> for months, but I've seen very little feedback - and no real resolutions -
> on this or the snort-devel list.  At this point, I suspect the developers
> know of the problem and don't know how to fix it, given the severe lack of
> responses and documentation.
>
> By the way, how did you fix the duplicate events/alerts problem?  I have
> ACID 0.9.6b21 as well and see the problem daily.  I have literally hundreds
> of events that can't be archived because they're "duplicate", but looking in
> the database there are no duplicates, but there are other events that
> somehow got the same sid:cid.  This is another thing I've been pleading with
> ANYONE to give me feedback on and, as always, have received none.
>
> mike
>
> -----Original Message-----
> From: Slighter, Tim [mailto:tslighter () itc nrcs usda gov]
> Sent: Thursday, September 05, 2002 3:05 PM
> To: 'snort-users () lists sourceforge net'
> Subject: [Snort-users] Acid Issues with snort
>
>
>
> I have installed the latest releases of everything:
>
> PHP 4.30
> ACID 0.9.6b21
> Apache 2.0.40
> mySQL 4.0.3
> Adodb 231
> GD 1.8.4
> Phplot 4.4.6
>
>
>  on a new system and have documented and witnessed the following anomalies:
>
> While the archiving feature now works, even with duplicate events/alerts,
> now the AG Maintenance has some issues.  When a new AG is created, only the
> ID shows up and no name.  Attempting to edit the AG or delete it and create
> a new one, does not fix this problem.  The name and description do NOT show
> up.
>
> The other issue is the graph tool.  This did work in the previous release
> for ACID prior to ACID 0.9.6b20 but now the graphs do not render and present
> broken graphics.  Guessing it has something to do with extracting the data
> from an AG, which are not functioning correctly.
>
> Anyone seen this or know of a "known" workaround ?
>
> Thanks



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users