[Snort-devel] Snort with Oracle DB

Esler, Joel - Contractor joel.esler at ...2021...
Thu Jan 20 05:51:50 EST 2005


ALL,
 
This error can be resolved by making the following changes to the
src/output-plugins/spo_database.c file in the Snort Source Code.  
 
This error was discovered by John Evans and I at our work location.
 
This is an Oracle Specific error and needs to be added to the Snort
Source Code in order to fix the error.  After these changes are made,
Snort needs to be recomplied.
 
# diff spo_database.c spo_new.c
1622c1622
<                             "VALUES ('%u','%u','%s",
---
>                             "VALUES
('%u','%u',utl_raw.cast_to_raw('%s",
1626c1626
<                     strcat(query->val, "')");
---
>                     strcat(query->val, "'))");
 
Joel
 
 

-----Original Message-----
From: snort-devel-admin at lists.sourceforge.net
[mailto:snort-devel-admin at lists.sourceforge.net] On Behalf Of Prestwich,
Carl L
Sent: Thursday, January 13, 2005 6:27 PM
To: snort-devel at lists.sourceforge.net
Subject: [Snort-devel] Snort with Oracle DB



All, 
      We have setup Snort to write directly to an Oracle database. About
a dozen times a day we receive the following error:

database: oracle_error: ORA-01704: string literal too long 

   Has anyone successfully changed snort to solve this issue. The insert
is failing for table data, field data_payload which has a datatype of
blob.

Thanks,
Carl 



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20050120/f70457ab/attachment.html>


More information about the Snort-devel mailing list