Re: snort and oralce (snort 1.90)

["Jarret Gibson" <jarret () osa comax com>]

I received almost identical error messages when attempting to log to MSSQL using various 1.9.x versions.  The response 
I received from Roman Danyliw (roman () danyliw com) was this:

"There were a couple of bugs in detecting the presence of MS-SQL Server in the
release of Snort 1.9.  These bugs have been addressed in CVS.  Update and
manually rebuild snort, or wait for a binary release."

Perhaps these same bugs are effecting you.  I've had to go back to 1.8.7 to get a version that successfully logs to 
MSSQL.

Jarret Gibson


  ----- Original Message ----- 
  From: gongya 
  To: roman () danyliw com 
  Cc: snort-users () lists sourceforge net 
  Sent: Friday, October 25, 2002 7:02 PM
  Subject: [Snort-users] snort and oralce (snort 1.90)


  Hi, anyone knows why for the following messages ?

  snort -i hme0 -l ./log -c etc/snort.conf 

  ...............................
  database: compiled support for ( oracle )
  database: configured to use oracle
  database:          user = snort
  database: password is set
  database: database name = ocean
  database:   sensor name = 192.168.1.23
  database: oracle_error: ORA-01403: no data found

  database: oracle_error: ORA-01400: cannot insert NULL into ("SNORT"."SENSOR"."LAST_CID")

  database: oracle_error: ORA-01403: no data found

  database: Problem obtaining SENSOR ID (sid) from ocean->sensor

   When this plugin starts, a SELECT query is run to find the sensor id for the
   currently running sensor. If the sensor id is not found, the plugin will run
   an INSERT query to insert the proper data and generate a new sensor id. Then a
   SELECT query is run to get the newly allocated sensor id. If that fails then
   this error message is generated.

   Some possible causes for this error are:
    * the user does not have proper INSERT or SELECT privileges
    * the sensor table does not exist

   If you are _absolutely_ certain that you have the proper privileges set and
   that your database structure is built properly please let me know if you
   continue to get this error. You can contact me at (roman () danyliw com).

  Fatal Error, Quitting..

  Note:
  1. Sensor is created.
  2. Have all the privileges for snort .

  thanks !!!

  Gongya Yu