[Snort-devel] Snort logging to Oracle
joey at ...60...
Thu May 24 12:58:47 EDT 2001
Jim could probably answer this better then me, but it is an issue with
SPADE and Oracle. One way around is to do the following:
1) remove the "inline" function types from those lines
2) change "min" and "max" to something like "smin" and "smax". Oracle
must be using min and max somewhere too. I haven't had the chance to
debug this one fully.
3) On line 322 of spp_anomsensor.h, replace "min" and "max" with "smin"
and "smax" respectively.
As far as your issue with missing files on the Oracle sensor, yes we
have had the same experience and did exactly what you did.
| Joe McAlerney joey at ...63... |
| Silicon Defense - Technical Support for Snort |
| http://www.silicondefense.com/ |
Vitaly Osipov wrote:
> Hi all,
> Do I need to install Oracle on sensor host to get snort logging to a remote
> database? I hope that not... I took some header files from oracle-linux
> 8.0.7, snort 1.8 compiles without complaining on header files missing, but
> there is a weird error -
> gcc -DHAVE_CONFIG_H -I. -I. -I. -I/usr/include/pcap -I/usr/include/mysql -D
> ENABLE_MYSQL -I/usr/local/rdbms/demo -I/usr/local/rdbms/public -I/usr/local/
> network/public -DENABLE_ORACLE -g -O2 -Wall -c spp_anomsensor.c
> spp_anomsensor.c:1781: parse error before `int'
> spp_anomsensor.c:1785: parse error before `int'
> make: *** [spp_anomsensor.o] Error 1
> (today's CVS snapshot)
> snort is configured --with-oracle --without-openssl --without-postgresql
> (--with-openssl also gives a strange error, but i'm more interested in
> oracle than in openssl).
> if i omit --with-oracle, everything compiles perfectly... do I miss
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
More information about the Snort-devel