Snort mailing list archives
Snort not loging on MySql
From: "Di Fresco Marco" <superdif () infinito it>
Date: Fri, 30 Jan 2004 12:39:36 -0800
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I temporarily solved my previous problem ("Device didn't translate") by setting in snort.conf the HOME_NET to my real IP address instead of using (\Device\NPF_{18...3C}). At the moment Snort works, but I have another problem. Basically the problem is that Snort does not log on my MySql server. I checked the archives of this ML and I also done a search on Google, but the only two solutions I found were to try to drop the snort database and recreate it, or to check the perimission of the snort user to make sure it can write to the snort database; I tried both solutions and they did not work (the implementation of the solutions worked, but Snort still does not log). Here my environment: WinXP Pro. (full patched) Snort 2.1.0 MySql 4.0.17 (all three software on the same standalone machine). Here an extract of my snort.conf: var HOME_NET [My IP address] var EXTERNAL_NET !$HOME_NET ... var SQL_SERVERS $HOME_NET ... output database: log, mysql, user=snort@localhost password=SNORTPASWORD dbname=snort host=localhost encoding=ascii detail=full ignore_dbf=0 For the part (of snort.conf) where all the rules are listed, I changed the path from relative ($RULE_PATH\) to absoulute (D:\Snort\rules\) And here is the syntax I use to launc Snort: D:\Snort\bin\snort.exe -c "D:\snort\etc\snort.conf" -l "D:\snort\Log" - -A full -i 1 -I -d -e -X Any suggestion? Thank in advance. Di Fresco Marco http://home.comcast.net/~superdif/ -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.3 iQIVAwUBQBq/TGFI2e+I8s0+AQKBeBAAgWoGF0DiT+VGbXD9IS9eM5rZjBKy3f4y OBbYFnfdJdaBwOKhR1r+xSCyqcrWa3M+9u5Qv7Ii1uCpAgFItrv5pnw9MTeL/uKf p9Ds+K0NbQmgvLuQDbSkz/QXxd/NIPsf4ses7N7TrA2AyBvTi3kEDilJySf5iyk4 8iUFI7+yGIjVKXiB0H0Az/MVnb5AIkwI/z5O7ROEHuusskBSXSPFH8XxPSXu7e95 R+nNWngN+BqI7sS8jaAXzdXx7SCnw5A8/EqrTy7y/VBD6URHULLI8RP9Ce38hEWz uL/VZPQOAe3Bvqmbr4pt9LBdwZkOsKEJNO+V1MMaEpdMD7yTzi+4yp19EhxzwN93 U3Qr8ep/Y/xPCjIrwCDKgmnyJLeHShmhqw4XkGaIniYqL3fMhig2Ocp+cDJDHGVR tq7S4STaXkiQok8ZPtbUk2bQh0+qSHZG4xuPk7G1VxLzsJyiQtJldbswQAnfmR/m WUJrcadvlqrrjXzzEH1eHz9M1P5Ez1D9rjTdo/7aYciDaHD720LAfJ2Aux1b2XON 23pG4fdU/bJ+gRYy1RxbiNKfqJMZgy7ucJEdb7/RohgpMLfYdcBUCXHeYa/rMHxJ X9Wqf9J9BsN4ElefOLMhWzuDG4scqdNjf4F5OzQ5LutegXCbauLR13byJv+pZ/AP /ALf9xepn14= =wfcK -----END PGP SIGNATURE----- ------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort not loging on MySql Di Fresco Marco (Feb 02)
- <Possible follow-ups>
- RE: Snort not loging on MySql Michael Steele (Feb 02)