Snort mailing list archives
AW: (Snort-users) MySQL Logging ?
From: <sandro.poppi () wacker com>
Date: Tue, 29 Jan 2002 07:15:00 +0100
Morning Brian, try to omit the -s command line switch and carefully have a look on the output when snort starts using the command in a shell: /usr/bin/snort -A full -i lo -N -c /etc/snort/snort.conf BTW: You also might want to get portscan alerts in the db in which case you have to change log to alert as in output database: alert, mysql, dbname=snort host=localhost ser=snortlog password=xxxxx sensor_name=mysensor HTH, Sandro
Hi! I'm trying to get Snort up and running - more or less according to the descriptions (HowTo) on the linuxdoc.org page... But I do not get any logging in the MySQL database ... The logging entry in snort.conf says: output alert_syslog: LOG_AUTH LOG_ALERT LOG_PID output database: log, mysql, dbname=snort host=localhost user=snortlog password=xxxxx sensor_name=mysensor The userid/pass etc for the SQL settings are correct, I am able to log in using the mysql command at a shell prompt... I get logging in /var/log/messages (when specifying -s option in /etc/rc.d/init.d/snortd) - but nothing is loggend in the MySQL database in the event table ?? Am I doing something wrong, or is it supposed to run like this ? Snort is started in the snortd file like: daemon /usr/bin/snort -A full -s -d -D \ -i $INTERFACE -N -c /etc/snort/snort.conf where interface for test purposes has been set to lo Regards, /Brian _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- AW: (Snort-users) MySQL Logging ? sandro.poppi (Jan 28)