[Snort-users] Snort 1.9, RH 7.3 and Acid

Beckett, Josh JBeckett at ...7082...
Fri Oct 4 13:15:01 EDT 2002


Ok...I was excited by the announcement of 1.9 and went and did a dumb
thing...upgraded right on a production box.  I did my initial setup
using the doc from the snort website "Snort Installation Manual: Snort,
MySQL and ACID on RedHat 7.3" (great doc, btw).

Every thing went fine relative to the upgrade, etc.  Compiled fine, used
the new conf file and "current" rules set.  Snort seems to be running
fine, but doesn't seem to want to log to ACID-MySQL.  As a
troubleshooting measure, I set "log to file" on as well as log to db, I
can see alerts going into a file, but not the db.  I've even gone and
blown away the db's and re-set them up, using the steps outlined in the
paper.  Still no joy.

I've triple checked the snort.conf file for silly things, like bad rules
path, bad db password and user name and everything seems to be
fine...still no alerts in the db, but alerts pop up in the file.  I've
even checked the configure.log to make sure that I compiled with the
--with-mysql switch...good there.

Any other places to check, where I might be having a problem?

Thanks,
Josh




More information about the Snort-users mailing list