[Snort-users] Alert Time/date stamps

Stuart Underhill stuartunderhill at ...125...
Thu Feb 7 01:01:05 EST 2002


I am currently configuring several Win2k Pro based Snort sensors for 
placement a key locations in our network.

Having followed the instructions from Silicon Defense, for Win32 Snort 1.8.3 
with MySQL/IIS/ACID, all appeared to be well and alerts are captured to the 
DB.

However, when reviewing the alerts (via ACID or direct from the MySQL DB) I 
notice that the datestamps do not reflect the time that the alert was 
generated. It appears to increment the time stamp by some random amount. For 
example, starting a run of approx 100 large ping attempts at a host - the 
first alerts was logged at 14:00 5th Feb 2002, the last alert had a 
timestamp of something like 06:00 6th Feb 2002 - all for an event which 
lasted a couple of minutes.

I since left the scanner running overnight to be presented with the last 
alert logged with a date in April 2002 !!

I tried adding a second hard disk to the machine and moving the MySQL DB and 
Snort to the new drive away from W2k and the swapfile. But this has not 
helped.

Has anybody experienced this behaviour before, or have any suggestion of how 
to rectify this??

Thanks in advance

Stuart Underhill

_________________________________________________________________
Join the world�s largest e-mail service with MSN Hotmail. 
http://www.hotmail.com





More information about the Snort-users mailing list