[Snort-users] Snort console errors - MSSQL

Jarret Gibson jarret at ...7313...
Fri Oct 25 14:41:04 EDT 2002


Running Snort 1.8.7 w/ MSSQL logging, Windows 2000, everything fully updated.

I've noticed that Snort seems to be logging fewer alerts now that it is logging to the MSSQL database as opposed to logging to a directory.  In the Snort console window, I'm seeing errors of this type pop up a decent bit:

----------------------------
database: SQL Server message 306, state 1, severity 16:
        The text, ntext, and image data types cannot be used in the WHERE, HAVING, or ON clause, except with the LIKE or IS NULL predicates.

Server 'ORANGE', Line 1

database:  The above error was caused by the following statement:
    SELECT ref_id FROM reference WHERE ref_system_id = 3 AND ref_tag = '341'

database: DB-Library error:
        General SQL Server error: Check messages from the SQL Server.

database:  The above error was caused by the following statement:
    SELECT ref_id FROM reference WHERE ref_system_id = 3 AND ref_tag = '341'

database: SQL Server message 306, state 1, severity 16:
        The text, ntext, and image data types cannot be used in the WHERE, HAVING, or ON clause, except with the LIKE or IS NULL predicates.

Server 'ORANGE', Line 1

database:  The above error was caused by the following statement:
    SELECT ref_id FROM reference WHERE ref_system_id = 3 AND ref_tag = '341'

database: DB-Library error:
        General SQL Server error: Check messages from the SQL Server.

database:  The above error was caused by the following statement:
    SELECT ref_id FROM reference WHERE ref_system_id = 3 AND ref_tag = '341'

database: Unable to insert the alert reference into the DB
----------------------------


It looks like it's failing to update on some of these alerts.  Any ideas on a fix for this?

Jarret Gibson
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20021025/c0b2b379/attachment.html>


More information about the Snort-users mailing list