Snort mailing list archives
Re: snort 1.9.0 + redhat 8.0: no output to mysql when in daemon mode
From: Erek Adams <erek () snort org>
Date: Fri, 21 Mar 2003 12:16:57 -0500 (EST)
On Fri, 21 Mar 2003, Tom Van Overbeke wrote: First off: Upgrade to 1.9.1. 1.9.0 has a security flaw with the RPC decoder that is remotely exploitable.
Snort refuses to write to mysql when it is started with the -A fast and the -D options. i tried all possible combinations, and as soon as one of these 2 parameters is mentioned, it defaults to the logfile. the -A i can do without, but i like to start all my daemons via the init.d scripts, and if i leave out the -D, snort remains attached to the terminal, which is not what a daemon should be doing. Does anyone know how I can have the -D option present and still log to database ? these are my snort.conf lines with respect to the output: output database: log, mysql, user=snort password=snort dbname=snort host=127.0.0.1 output database: alert, mysql, user=snort password=snort dbname=snort host=127.0.0.1
I think your problem is quite as it appears. Make sure you can log to the DB at all. I'm thinking that you are getting an error, and since -D kills most of the output, you're not seeing the error. Try to start with just: snort <options> And don't have the -D in there. See if it can log to your DB and if you can see the data. If so, try starting it with -D to see if you still get data. I have a feeling that you're not getting any data in there at all.... Cheers! ----- Erek Adams "When things get weird, the weird turn pro." H.S. Thompson ------------------------------------------------------- This SF.net email is sponsored by:Crypto Challenge is now open! Get cracking and register here for some mind boggling fun and the chance of winning an Apple iPod: http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0031en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- snort 1.9.0 + redhat 8.0: no output to mysql when in daemon mode Tom Van Overbeke (Mar 21)
- Re: snort 1.9.0 + redhat 8.0: no output to mysql when in daemon mode Erek Adams (Mar 21)
- Re: snort 1.9.0 + redhat 8.0: no output to mysql when in daemon mode Erek Adams (Mar 21)