[Snort-devel] BUG : Databases output module

Erek Adams erek at ...835...
Mon Jan 13 06:37:04 EST 2003


On Mon, 13 Jan 2003, [iso-8859-1] Sébastien Desse wrote:

> There is something i'd like to report as a bug.
> I use Mysql output module to log into a remote mysql/ACID database.
> Where starting snort, if the database server is not available, the program
> exits.
> I think it is because database output module exits if it is unable to
> connect.
>
> !! I think it should not make snort startup fail !!
>
> I'd like to know if it is possible to make db output module report the error
> and let snort startup continue ?
> Can this output module retry to connect later or send error messages...

*sigh*

Barnyard handles this.

	http://www.snort.org/dl/barnyard/

Spool unified output to disk where BY grabs it.  Then BY will send it to
the remote DB.  If it can't connect BY is smart enough to wait and try
again while still holding the data.

Have a look at it.

-----
Erek Adams

   "When things get weird the wierd turn pro."   H.S. Thompson




More information about the Snort-devel mailing list