RE: Snort upgrade/MySQL database problems

["Hutchinson, Andrew" <andrew.hutchinson () Vanderbilt Edu>]

Hmm.  If you upgraded your schema during the 1.8 -> 1.9 move, you should
be running the 106 schema, which should have the last_cid entry in the
sensors table.

Can you run a "select * from schema" to make sure that you're running
106.  If you are, then run a "desc sensor" and see if it includes the
last_cid field.  If it does not, then run:

ALTER TABLE sensor ADD last_cid INT UNSIGNED NOT NULL

That should add that column with the correct datatype.  I'd still be
somewhat curious why it isn't there if the schema table says it's 106,
though...

Andrew

Andrew Hutchinson - Network Security
Vanderbilt University Medical Center
(615) 936-2856


> -----Original Message-----
> From: Marc Quibell [mailto:mquibell () fbfs com] 
> Sent: Monday, July 07, 2003 10:21 AM
> To: snort-users () sourceforge net
> Subject: [Snort-users] Snort upgrade/MySQL database problems
>
>
>
>
> I have two sensors installed. I just upgraded the OTHER 
> sensor to Snort 2.0. I
> previously upgrade a current system to 2.0 a month or so ago. 
> Now I am combining
> the two into the 1.9 MySQL database. I upgraded the schema 
> during my 1.8 > 1.9
> migration. Now when I bring my old Snort 2.0 in with the new 
> onto the MySQL
> database, i get the error:
>
> Jul  1 10:03:41 Security snort: database: mysql_error: 
> Unknown column 'last_cid'
>  in 'field list' SQL=INSERT INTO sensor (hostname, interface, detail,
> encoding, last_cid) VALUES ('Internal','eth1','1','0', '0')
> Jul  1 10:03:41 Security snort: database: Problem obtaining 
> SENSOR ID (sid) from
>  snortmasterdatabase->sensor
> Jul  1 10:03:41 Security snort: FATAL ERROR:   When this 
> plugin starts, a SELECT
>  query is run to find the sensor id for the  currently running sensor.
> If the sensor id is not found, the plugin will run  an INSERT 
> query to insert
> the proper data and generate a new sensor id. Then a  SELECT 
> query is run to
> get the newly allocated sensor id. If that fails then  this 
> error message is
> generated.   Some possible causes for this error are:
>  * the user does not have proper INSERT or SELECT privileges  
>  * the sensor
> table does not exist   If you are _absolutely_ certain that 
> you have the
> proper privileges set and  that your database structure is 
> built properly please
>  let me know if you  continue to get this error. You can contact me at
> (roman () danyliw com).
>
> I checked and rechecked db rights on the new system, the user 
> has full rights to
>  the database. I've checked many resources, including snort 
> discussions, to no
> avail.
> The only thing I've found on this was an older bug. TIA!
>
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> Data Reports, E-commerce, Portals, and Forums are available now.
> Download today and enter to win an XBOX or Visual Studio .NET.
> http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_06
> 1203_01/01
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users