snort and mysql5 losing db connection

["Greg King" <j.greg.k () gmail com>]

I posted this on the forums a few days ago but since there has been no
replies I am asking anyone on this list for assistance.


Most of my sensors are running on centos 4 without a problem using mysql and
base. To start getting familiar with CentOS 5 i built a test sensor which
comes with mysql 5. I compiled the latest snort 2.6.x version.

What happens if I do not get any alarms is snort loses the connection and
starts throwing various errors like

snort[7890]: database: mysql_error: MySQL server has gone away

The database is working fine. I can still connect to it.

Googling, the only explanation with a possible fix I found was at

http://www.uno-code.com/?q=node/81

Quoteing from the above link:

"The other issue that was extremely hard to track down was when a large gap
of time (usually 4-6 hours) between alerts occurred. At this time Snort
states that MySQL has gone away. It appears that Snort needs a persistent
connection to MySQL, and when a gap occurs that connection is lost or
'released' due to timeout, and Snort doesn't initiate a new connection to
MySQL."

Any ideas on how to deal with this instead of setting the wait_timeout =
10000000 in my.cnf? Another thread back in 2005 mentioned to use barnyard
and not the sql connector. That is not an option for base and probably would
fail with aanval users as well. I could simply go back to centos4 but that
just delays the issue instead of fixing it.

thanks

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users