Re: acid-0.9.6b18 - problems with postgresql

[Hugh Fraser <hugh_fraser () dofasco ca>]

Vladimir Strezhnev wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> (Snort 1.8.2, postgresql 7.1.3, acid-0.9.6b18)
>
> Acid-0.9.6b18 and the latest acid CVS produce the following error loading the 
> acid_main.php screen when configured with postgresql support 
>
> Database ERROR:Database ERROR:ERROR: Aggregate functions may only have one 
> parameter
>
> All previous recent versions (tested b13, b14, b17)  work fine with the same 
> configuration.
>
> - -- 
> VLADIMIR STREZHNEV
> System Engineer
> IndiVisual Learning, LLC
> St. Paul, MN 
> -----BEGIN PGP SIGNATURE-----
> Version: PGP 6.5.8
>
> iQA/AwUBO/VcUr5tPDt+Qc/uEQJvRQCcDgcaKEyya4LZPqGqg3e5fcgF5coAoKdO
> y7z8aVUlpiED1VoTnBBQwDCN
> =D3Wf
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
There's at least one change that needs to go into ACID.

diff ./acid_stat_common.php /var/www/html/acid/acid_stat_common.php
308c308
<      $result = $db->acidExecute("SELECT COUNT(DISTINCT 
acid_event.ip_src, acid_event.ip_dst, acid_event.ip_proto) FROM 
acid_event");
---
>      $result = $db->acidExecute("SELECT COUNT(DISTINCT 
acid_event.ip_src), COUNT(DISTINCT acid_event.ip_dst), COUNT(DISTINCT 
acid_event.ip_proto) FROM acid_event");
310c310
<      $result = $db->acidExecute("SELECT COUNT(DISTINCT 
acid_event.ip_src, acid_event.ip_dst, acid_event.ip_proto) FROM 
acid_event $join $where");
---
>      $result = $db->acidExecute("SELECT COUNT(DISTINCT 
acid_event.ip_src), COUNT(DISTINCT acid_event.ip_dst), COUNT(DISTINCT 
acid_event.ip_proto) FROM acid_event $join $where");

I expect this aggregating that Postgres doesn't like happens in other 
modules as well.



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users