RE: Snort-MySQL problem

[CMartin () infosol com]

It is my understanding that the snort.conf file is only read when the
program loads.  The snort.conf file basically tells the program how to
configure itself when it is loaded into memory.  Such as whether to log to
the database or to a certain file type, as well as what processors to use.
This file is read once and not referred to again while snort is running.


Chris

P.s. If anyone knows if I'm wrong in making this assumption about snort.conf
please let me know :)  I don't fear mistakes, but embrace them :P

-----Original Message-----
From: Syed Zuhdi Syed Salim [mailto:syzuhdi () penawargroup com] 
Sent: Wednesday, October 01, 2003 6:37 PM
To: CMartin () infosol com
Subject: RE: [Snort-users] Snort-MySQL problem

It's work !!!
Another question from me:
My Snort is automatic running,but why it doesn't read snort.conf file?


Quoting CMartin () infosol com:

> It would appear that you are running snort in Test mode.  I noticed you
used
> the -T option in the command line.  This tells snort to test the config
file
> and then exit.  So just remove the -T and you will be all set.
>
>
> Chris
>
> -----Original Message-----
> From: Syed Zuhdi Syed Salim [mailto:syzuhdi () penawargroup com] 
> Sent: Tuesday, September 30, 2003 7:31 PM
> To: snort-users () lists sourceforge net
> Subject: [Snort-users] Snort-MySQL problem
>
> Hi,
>
> Snort doesn't log into MySQL database. How to solve this problem???
> This the output when I running command : 
>
> [root@medinetserver bin]# snort -c /etc/snort/snort.conf -i eth0 -T
> Running in IDS mode
> Log directory = /var/log/snort
>  
> Initializing Network Interface eth0
>  
>         --== Initializing Snort ==--
> Initializing Output Plugins!
> Decoding Ethernet on interface eth0
> Initializing Preprocessors!
> Initializing Plug-ins!
> Parsing Rules file /etc/snort/snort.conf
>  
> +++++++++++++++++++++++++++++++++++++++++++++++++++
> Initializing rule chains...
> No arguments to frag2 directive, setting defaults to:
>     Fragment timeout: 60 seconds
>     Fragment memory cap: 4194304 bytes
>     Fragment min_ttl:   0
>     Fragment ttl_limit: 5
>     Fragment Problems: 0
>     Self preservation threshold: 500
>     Self preservation period: 90
>     Suspend threshold: 1000
>     Suspend period: 30
> Stream4 config:
>     Stateful inspection: ACTIVE
>     Session statistics: INACTIVE
>     Session timeout: 30 seconds
>     Session memory cap: 8388608 bytes
>     State alerts: INACTIVE
>     Evasion alerts: INACTIVE
>     Scan alerts: ACTIVE
>     Log Flushed Streams: INACTIVE
>     MinTTL: 1
>     TTL Limit: 5
>     Async Link: 0
>     State Protection: 0
>     Self preservation threshold: 50
>     Self preservation period: 90
>     Suspend threshold: 200
>     Suspend period: 30
> Stream4_reassemble config:
>     Server reassembly: INACTIVE
>     Client reassembly: ACTIVE
>     Reassembler alerts: ACTIVE
>     Ports: 21 23 25 53 80 110 111 143 513 1433
>     Emergency Ports: 21 23 25 53 80 110 111 143 513 1433
> http_decode arguments:
>     Unicode decoding
>     IIS alternate Unicode decoding
>     IIS double encoding vuln
>     Flip backslash to slash
>     Include additional whitespace separators
>     Ports to decode http on: 80
> rpc_decode arguments:
>     Ports to decode RPC on: 111 32771
>     alert_fragments: INACTIVE
>     alert_large_fragments: ACTIVE
>     alert_incomplete: ACTIVE
>     alert_multiple_requests: ACTIVE
> telnet_decode arguments:
>     Ports to decode telnet on: 21 23 25 119
> database: compiled support for ( mysql )
> database: configured to use mysql
> database:          user = snort
> database: password is set
> database: database name = snort
> database:          host = localhost
> database:   sensor name = 192.168.0.3
> database:     sensor id = 1
> database: schema version = 106
> database: using the "log" facility
> 1454 Snort rules read...
> 1454 Option Chains linked into 146 Chain Headers
> 0 Dynamic rules
> +++++++++++++++++++++++++++++++++++++++++++++++++++
>  
> Rule application order: ->activation->dynamic->alert->pass->log
>  
>         --== Initialization Complete ==--
>  
> -*> Snort! <*-
> Version 2.0.1 (Build 88)
> By Martin Roesch (roesch () sourcefire com, www.snort.org)
>  
> Snort sucessfully loaded all rules and checked all rule chains!
> database: Closing connection to database "snort"
> Snort exiting
> [root@medinetserver bin]#
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



dnAYMPDP


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users