Errors with simultaneous outputs in database

[Muad Dib <bizou31 () yahoo fr>]

Hi all,

I used to using BASE + Snort 2.3.3 with a postgres sql
output 

Everything worked fine

But yesterday, i used my master-snort-box to build
snort-box-children and then problems begun.

Some snort-boxes are placed before and after some
firewalls ( say s1 before and s2 after)

In the case an alert is received from s1 and then from
s2, (time delay is very short : <1ms ) it seems to
create a bug in the database :

Here is what snort says :
Jun 22 11:44:14 s3 snort: database: warning (SELECT
sig_id   FROM signature  WHERE sig_name = 'SNMP
missing community string attempt'    AND sig_rev = 4  
 AND sig_sid = 1893 ) returned more than one result 
Jun 22 11:44:14 s3 snort: database: warning (SELECT
sig_class_id   FROM sig_class  WHERE sig_class_name =
'misc-attack') returned more than one result 
Jun 22 11:44:14 s3 snort: database: warning (SELECT
sig_class_id   FROM sig_class  WHERE sig_class_name =
'misc-attack') returned more than one result 
Jun 22 11:44:14 s3 snort: database: unable to write
classification 
Jun 22 11:44:14 s3 snort: database: warning (SELECT
sig_id   FROM signature  WHERE sig_name = 'SNMP
missing community string attempt'    AND sig_rev = 4  
 AND sig_sid = 1893 ) returned more than one result 
Jun 22 11:44:14 s3 snort: database: Problem inserting
a new signature 'SNMP missing community string
attempt' 
Jun 22 11:44:14 s3 snort: database: warning (SELECT
ref_id   FROM reference  WHERE ref_system_id = 2   
AND ref_tag = '1999-0517') returned more than one
result 
Jun 22 11:44:14 s3 snort: database: warning (SELECT
ref_id   FROM reference  WHERE ref_system_id = 2   
AND ref_tag = '1999-0517') returned more than one
result 
Jun 22 11:44:14 s3 snort: database: Unable to insert
the alert reference into the DB 
Jun 22 11:44:14 s3 snort: database: postgresql_error:
ERROR:  duplicate key violates unique constraint
"sig_reference_pkey"  
Jun 22 11:44:14 s3 snort: database: postgresql_error:
ERROR:  current transaction is aborted, commands
ignored until end of transaction block  
Jun 22 11:44:14 s3 snort: database: Unable to insert
unknown reference tag ('2112') used in rule. 
Jun 22 11:44:14 s3 snort: database: postgresql_error:
ERROR:  current transaction is aborted, commands
ignored until end of transaction block  

The other snort is saying the same thing.

And as a matter of fact, in the table signature for
instance, i can see several entries for 
:SELECT sig_id   
:FROM signature  
:WHERE sig_name = 'SNMP missing community string at
:tempt'    
:AND sig_rev = 4    
:AND sig_sid = 1893
I should have only one there

I've checked the spo_database.c from snort but as i'm
not a C addicted, i did not found error

The postgres logs confirms this bug :
ERROR:  duplicate key violates unique constraint
"sig_reference_pkey"
ERROR:  duplicate key violates unique constraint
"sig_reference_pkey"
ERROR:  current transaction is aborted, commands
ignored until end of transaction block
ERROR:  current transaction is aborted, commands
ignored until end of transaction block
ERROR:  current transaction is aborted, commands
ignored until end of transaction block
ERROR:  current transaction is aborted, commands
ignored until end of transaction block
ERROR:  current transaction is aborted, commands
ignored until end of transaction block
ERROR:  current transaction is aborted, commands
ignored until end of transaction block

I've already checked similar subjects on mailing
lists, but none helped

Each sensor is running in daemon mode
Each sensor is configured with a different sensor_name
in the output
All sensors have the same rules revision
Base scheme is built from create_postgresql from snort
sources
I've tried to purge the DB scheme and recreate this.
It works until i have only s1 running. When s2 is
running, it does not take long to generate errors

If a snort guru could have a look , i would be very
grateful since i'm in a real hurry to have this
project working.

Thanks for reading


        

        
                
___________________________________________________________________________ 
Appel audio GRATUIT partout dans le monde avec le nouveau Yahoo! Messenger 
Téléchargez cette version sur http://fr.messenger.yahoo.com


-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users