[Snort-users] mysql.sock - where?

Thomas Springer tuev at ...4508...
Tue May 7 05:49:02 EDT 2002


i'm using snort 1.86/mysql/acid on suse 7.3, all used to work (very!) fine.
i had mysql compiled to use /var/lib/mysql/mysql.sock - snort worked fine
with this.

now i updated mysql and recompiled it to use the (standardpath)
/tmp/mysql.sock
since then, snort complains 

--
/usr/sbin/snort -b -c /etc/snort/snort.conf
[usual blabla]
database: mysql_error: Can't connect to local MySQL server through socket
'/var/lib/mysql/mysql.sock' (2)
--
snort.conf reads:
output database: log, mysql, dbname=snort user=snort host=localhost
password=xxx sensor_name=9 detail=full encoding=ascii

I tried
- recompiling (./configure && make): Can't connect through /var/lib...
- make clean, deleted sources&binaries, recompiled: Can't connect through
/var/lib...
- make clean and recompiling mysql, changed .sock-setting in my.cnf to
/tmp/mysql.sock

Other apps work, Mysql works. Why doesn't Snort?
How does snort determine wich mysql.sock is used? 

Any hints to make me happier?




Thomas Springer





More information about the Snort-users mailing list