Snort mailing list archives

Re: Snort not connecting to MySQL


From: "Michael J. Ayers" <ayersmj () eidogen com>
Date: 15 Jan 2003 12:02:40 -0800

Ok...yes...sometimes even I am stupid.  Fixed.  Thanks guys.

On Wed, 2003-01-15 at 11:49, Demetri Mouratis wrote:
6.15 --faq-- --snort-- --faq-- --snort-- --faq-- --snort-- --faq--

http://www.snort.org/docs/faq.html
On 15 Jan 2003, Michael J. Ayers wrote:

I am executing snort with the following command line:

/usr/sbin/snort -A fast -b -l /var/log/snort -d -D -i eth0 -c
/etc/snort/snort.conf

It listens on eth0 but should send reports out via eth1 (snort is
running on the firewall).  The command above outputs nothing but the
following:

Initializing Output Plugins!

Then nothing.  No connections to mysql or anything.  But it is working
just fine.  When I check in /var/log/snort I see exactly what I should
be seeing on the snort box itself.


On Wed, 2003-01-15 at 11:00, Bamm Visscher wrote:
Please provide more information. Your problem can be caused by numerous misconfigurations. What, if any, errors 
are you receiving when running snort w/o the -D switch? What is the exact line you are starting snort with? What 
plugins are enabled in your snort.conf? Etc, etc, etc.

Bammkkkk

On Wed, Jan 15, 2003 at 10:37:00AM -0800, Michael J. Ayers wrote:
I have snort installed and working for the most part...but the only
thing that is not working is it is not connecting to the mysql database
to update it.  I have verified that the host running snort CAN access
the database...it just seems that snort isn't.  I have quadruple checked
the following and it is correct:

output database: log, mysql, user=snort password=snort dbname=snort
host=10.0.0.2 port=3306

Can anyone give me a heads up on how to figure out what is going on here
that it is not connecting or how to turn on mysql logging?

Thanks.

--
Michael J. Ayers
IT Manager
Eidogen Inc.
ayersmj () eidogen com
626.817.2266


-------------------------------------------------------
This SF.NET email is sponsored by: A Thawte Code Signing Certificate
is essential in establishing user confidence by providing assurance of
authenticity and code integrity. Download our Free Code Signing guide:
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0028en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
--
Michael J. Ayers
IT Manager
Eidogen Inc.
ayersmj () eidogen com
626.817.2266

This e-mail message is for the sole use of the intended recipient(s) and
may contain confidential information. Any review, use, disclosure or
distribution by persons or entities other than the intended recipient(s)
is prohibited.  If you are not the intended recipient or have any
questions concerning whether or not you  should be receiving this
disclosure, please contact the sender  by reply and destroy all copies
of the original message. Thank you.



-------------------------------------------------------
This SF.NET email is sponsored by: A Thawte Code Signing Certificate
is essential in establishing user confidence by providing assurance of
authenticity and code integrity. Download our Free Code Signing guide:
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0028en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


---------------------------------------------------------------------
Demetri Mouratis
dmourati () linfactory com
-- 
Michael J. Ayers
IT Manager
Eidogen Inc.
ayersmj () eidogen com
626.817.2266

This e-mail message is for the sole use of the intended recipient(s) and
may contain confidential information. Any review, use, disclosure or
distribution by persons or entities other than the intended recipient(s)
is prohibited.  If you are not the intended recipient or have any
questions concerning whether or not you  should be receiving this
disclosure, please contact the sender  by reply and destroy all copies
of the original message. Thank you.



-------------------------------------------------------
This SF.NET email is sponsored by: A Thawte Code Signing Certificate 
is essential in establishing user confidence by providing assurance of 
authenticity and code integrity. Download our Free Code Signing guide:
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0028en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: