Snort mailing list archives

MySQL Disconnects


From: adam_peterson () splwg com
Date: Wed, 26 Nov 2003 09:23:38 -0800

I have 2 sensors running at remote locations where bandwidth isn't exactly 
the best.  It looks like snort is losing connection to my MySQL server 
accross the link.  I have 1 other sensor in the exact same scenario and it 
never loses connection.  I'm determining this by running netstat on the 
remote box and seeing only my ssh connection.  If I restart snort, I see a 
connection on port 3306 to my MySQL server.

Does anyone know why this is happening?  My guess would be a timeout 
somewhere but I would hope that snort would re-establish the connection if 
it needs to.  I know that these sensors are getting alerts but aren't able 
to send them to the db because of the disconnect.

Any help is greatly appreciated.

Adam Peterson | Senior WAN Engineer | SPL WorldGroup | 
adam_peterson () splwg com

Current thread: