RE: [RGSPAM] RE: Snort Beta v2.6

["Ron Jenkins" <rjenkins () dibr net>]

I'm sorry to be a pain, but now I am getting the below MySQL errors with
v2.6.  Version 2.4.4 works fine.

 

database: mysql_error: Unknown column 'sig_gid' in 'where clause'

database: mysql_error: Unknown column 'sig_gid' in 'field list'

SQL=INSERT INTO signature
(sig_name,sig_class_id,sig_priority,sig_rev,sig_sid,sig_gid) VALUES
('MISC MS Terminal server request',1,3,13,1448,1)

database: mysql_error: Unknown column 'sig_gid' in 'where clause'

database: Problem inserting a new signature 'MISC MS Terminal server
request'

database: mysql_error: Duplicate entry '0-1' for key 1

SQL=INSERT INTO sig_reference (sig_id, ref_seq, ref_id) VALUES (0, 1, 3)

database: mysql_error: Duplicate entry '0-2' for key 1

SQL=INSERT INTO sig_reference (sig_id, ref_seq, ref_id) VALUES (0, 2,
1284)

database: mysql_error: Duplicate entry '0-3' for key 1

SQL=INSERT INTO sig_reference (sig_id, ref_seq, ref_id) VALUES (0, 3, 1)

database: mysql_error: Duplicate entry '0-4' for key 1

SQL=INSERT INTO sig_reference (sig_id, ref_seq, ref_id) VALUES (0, 4, 2)

database: mysql_error: Unknown column 'sig_gid' in 'where clause'

database: mysql_error: Unknown column 'sig_gid' in 'field list'

SQL=INSERT INTO signature
(sig_name,sig_class_id,sig_priority,sig_rev,sig_sid,sig_gid) VALUES
('BLEEDING-EDGE POLICY MSN status change',10,1,2,2002192,1)

database: mysql_error: Unknown column 'sig_gid' in 'where clause'

database: Problem inserting a new signature 'BLEEDING-EDGE POLICY MSN
status change'

database: mysql_error: Unknown column 'sig_gid' in 'where clause'

database: mysql_error: Unknown column 'sig_gid' in 'field list'

SQL=INSERT INTO signature
(sig_name,sig_class_id,sig_priority,sig_rev,sig_sid,sig_gid) VALUES
('BLEEDING-EDGE POLICY MSN status change',10,1,2,2002192,1)

database: mysql_error: Unknown column 'sig_gid' in 'where clause'

database: Problem inserting a new signature 'BLEEDING-EDGE POLICY MSN
status change'

 

 

Thanks...

 

-----Original Message-----
From: Jason Brvenik [mailto:jasonb () sourcefire com] 
Sent: Monday, March 20, 2006 8:02 PM
To: Ron Jenkins
Cc: snort-users () lists sourceforge net
Subject: Re: [RGSPAM] RE: [Snort-users] Snort Beta v2.6

 

response inline.

 

Ron Jenkins wrote:

 

> I got it to load with the following; thanks Jason:

>

Good to hear. Happy to help.

 

>  

>

> /usr/local/bin/snort -e -i eth1 -d -c /etc/snort/snort.conf -l

> /var/log/snort --dynamic-preprocessor-lib

> /usr/local/lib/snort_dynamicpreprocessor/libsf_ftptelnet_preproc.so 

> --dynamic-preprocessor-lib

> /usr/local/lib/snort_dynamicpreprocessor/libsf_smtp_preproc.so

>

>  

>

>  

>

> Does anyone know what these messages refer too?

>

>  

>

> /Warning: flowbits key 'http.jpeg' is checked but not ever set./

>

> /Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set./

>

> /Warning: flowbits key 'dce.bind.veritas' is set but not ever
checked./

>

> /Warning: flowbits key 'netbios.lsass.bind.attempt' is checked but not

> ever set./

>

> /Warning: flowbits key 'dce.isystemactivator.bind.call.attempt' is set

> but not ever checked./

>

> /Warning: flowbits key 'trojan' is set but not ever checked./

>

> /Warning: flowbits key 'realplayer.playlist' is checked but not ever
set./

>

These indicate that some rules set or check flowbits but there are no

rules which set or check them. This is normal from time to time as bits

are often set for future checks, for rule chains that may be disabled,

or for rules that have been moved out. If these are never checked the

rules that set them are _usually_ safe to disable as well.

 

> //

>

>  

>

> /Not Using PCAP_FRAMES/

>

>  

>

You are not using a setting that can help with performance.

 

http://www.snort.org/docs/snort_htmanuals/htmanual_2.4/rc1/node27.html