[Snort-users] mysql.sock - where?

Thomas Springer tuev at ...4508...
Tue May 7 05:49:02 EDT 2002

i'm using snort 1.86/mysql/acid on suse 7.3, all used to work (very!) fine.
i had mysql compiled to use /var/lib/mysql/mysql.sock - snort worked fine
with this.

now i updated mysql and recompiled it to use the (standardpath)
since then, snort complains 

/usr/sbin/snort -b -c /etc/snort/snort.conf
[usual blabla]
database: mysql_error: Can't connect to local MySQL server through socket
'/var/lib/mysql/mysql.sock' (2)
snort.conf reads:
output database: log, mysql, dbname=snort user=snort host=localhost
password=xxx sensor_name=9 detail=full encoding=ascii

I tried
- recompiling (./configure && make): Can't connect through /var/lib...
- make clean, deleted sources&binaries, recompiled: Can't connect through
- make clean and recompiling mysql, changed .sock-setting in my.cnf to

Other apps work, Mysql works. Why doesn't Snort?
How does snort determine wich mysql.sock is used? 

Any hints to make me happier?

Thomas Springer

More information about the Snort-users mailing list