[Snort-devel] Snort doesnt log in *hdr tables

Roman Danyliw roman at ...49...
Mon Oct 14 06:51:02 EDT 2002


Rok,

> I was playing a little using 1.9.0 version and used logging into MSSQL
> server, but
> it doesnt log headers into *hdr tables. I checked source and there are
> INSERT statements
> to use those tables, so i guess i am doing something wrong, but i was
> unable to find
> what... any help?

Can you confirm that the INSERT statements are being executed?  Are you
getting successful INSERTS for the event table?  Any chance this could be
due to unflushed transactions (if the event table is also not getting
updates)?

> Allso there are some bugs with using transactions with MSSQL;
> one is in [spo_database, 816];

Fixed.  I don't have a MS-SQL server to test against, but the
documentation seems to say that SQL should be "BEGIN TRAN, COMMIT TRAN,
ROLLBACK TRAN".  Let me know if this is incorrect.

> ... but after fixing it there was problems with BEGIN -> COMMIT pairs,
> so i kicked transactions
> out.

This is a bit odd, for there is only one BEGIN/COMMIT pair in the main
code.  Could this have been related to the SQL syntax error?

> Another problem is with one of #ifndef MSSQL as it should be #ifdef, but
> as i allready changed the
> source, i cant remember where it was :D

A fix for this was committed to CVS yesterday.

[snip]

Update from CVS (-r SNORT_1_9) and let us know where you stand.

Roman






More information about the Snort-devel mailing list