RE: [Snort-devel] Snort with Oracle DB

["Esler, Joel - Contractor" <joel.esler () rcert-s army mil>]

ALL,
 
This error can be resolved by making the following changes to the
src/output-plugins/spo_database.c file in the Snort Source Code.  
 
This error was discovered by John Evans and I at our work location.
 
This is an Oracle Specific error and needs to be added to the Snort
Source Code in order to fix the error.  After these changes are made,
Snort needs to be recomplied.
 
# diff spo_database.c spo_new.c
1622c1622
<                             "VALUES ('%u','%u','%s",
---
>                             "VALUES
('%u','%u',utl_raw.cast_to_raw('%s",
1626c1626
<                     strcat(query->val, "')");
---
>                     strcat(query->val, "'))");
 
Joel
 
 

-----Original Message-----
From: snort-devel-admin () lists sourceforge net
[mailto:snort-devel-admin () lists sourceforge net] On Behalf Of Prestwich,
Carl L
Sent: Thursday, January 13, 2005 6:27 PM
To: snort-devel () lists sourceforge net
Subject: [Snort-devel] Snort with Oracle DB



All, 
      We have setup Snort to write directly to an Oracle database. About
a dozen times a day we receive the following error:

database: oracle_error: ORA-01704: string literal too long 

   Has anyone successfully changed snort to solve this issue. The insert
is failing for table data, field data_payload which has a datatype of
blob.

Thanks,
Carl