Snort mailing list archives
Re: acid empty but mysql working
From: Dirk Geschke <dirk () geschke-online de>
Date: Wed, 7 Jul 2004 22:37:56 +0200
Hi Adam,
and barnyard.conf configured as follows: config hostname: localhost config interface: eth1 output alert_acid_db: mysql, sensor_id 1, database snort, server ids2.ops.domain.com , user snort, password snort output log_acid_db: mysql, sensor_id 1, database snort, server ids2.domain.pirtgroup.com , user snort, password snort , detail full
[...]
data appears in the db in almost all tables but _NOTHING_ is showing up in ACID. Also the sensor table is empty, and the acid_* tables are empty, isnt that supposed to be populated by barnyard? anybody know why acid wont view all the data that exists in my DB?
I guess the problem results from the missing sensor table entry. If you mention a sensor_id greater zero in output alert_acid_db then barnyard will use this id without checking if it exists. So at first remove either this part or set: sensor_id 0 BTW: A hostname of localhost is a bad sensor name... Best regards Dirk ------------------------------------------------------- This SF.Net email sponsored by Black Hat Briefings & Training. Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- acid empty but mysql working Adam Denenberg (Jul 07)
- Re: acid empty but mysql working Dirk Geschke (Jul 07)