Re: acid empty but mysql working

[Dirk Geschke <dirk () geschke-online de>]

Hi Adam,

> and barnyard.conf configured as follows:
>
> config hostname: localhost
> config interface: eth1
> output alert_acid_db: mysql, sensor_id 1, database snort, server
> ids2.ops.domain.com , user snort, password snort
> output log_acid_db: mysql, sensor_id 1, database snort, server
> ids2.domain.pirtgroup.com , user snort, password snort , detail full

[...]

> data appears in the db in almost all tables but _NOTHING_ is showing
> up in ACID.  Also the sensor table is empty, and the acid_* tables are
> empty, isnt that supposed to be populated by barnyard?
>
>  anybody know why acid wont view all the data that exists in my DB?

I guess the problem results from the missing sensor table entry.

If you mention a sensor_id greater zero in output alert_acid_db
then barnyard will use this id without checking if it exists.

So at first remove either this part or set: sensor_id 0

BTW: A hostname of localhost is a bad sensor name...

Best regards

Dirk


-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 - 
digital self defense, top technical experts, no vendor pitches, 
unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users