[Snort-users] ODBC+TDS woes

Jeff jeffi at ...1364...
Mon Apr 14 08:20:07 EDT 2003


   I have seen a handful of messages along a similar vein to this, without much
successful followup,  I can only hope that this turns out differently.

FreeBSD 4.7
Snort 1.9.1
FreeTDS 0.61
unixODBC 2.2.4

I am trying to get snort to log to an MSSQL 2000 database via unixODBC+FreeTDS.
Every single time snort quits on startup with the following:

database: ODBC unable to connect
Fatal Error, Quitting..

Here is the relevent snort.conf line(s) that have been tested (carriage returns
	are not really there in the config):

#output database: log, odbc, user=snort password=xxxx dbname=snort_log 
	host=myserver sensor_name=dmz ignore_bpf=yes
#output database: log, odbc, user=snort password=xxxx dbname=snort_log 
	host= sensor_name=dmz ignore_bpf=yes
output database: log, odbc, user=snort password=xxxx dbname=snort_log 

Here is odbcinst.ini

Description             = FreeTDS unixODBC Driver
Driver          = /usr/local/lib/libtdsodbc.so
FileUsage               = 1

(note: odbc.ini is empty, but I have followed the directions here:


        query tcp 7.0 1433


        host =
        port = 1433
        tds version = 7.0

I can connect to the database via the commandline "isql", and I have setup 
tcpdump to view the traffic when snort starts up, and I see no attempts at any
sort of ODBC connection. I have compiled FreeTDS with both --with-tdsver=7.0 
and --with-tdsver=4.2, with the same results.  I am using the FreeBSD port and
I have compiled the snort (1.9.1) port WITH_MYSQL and WITH_ODBC, FreeTDS is 

As far as I can tell, there is no library problem, everything is linked
        libz.so.2 => /usr/lib/libz.so.2
        libpcap.so.2 => /usr/lib/libpcap.so.2
        libm.so.2 => /usr/lib/libm.so.2
        libmysqlclient.so.10 => /usr/local/lib/mysql/libmysqlclient.so.10
        libodbc.so.1 => /usr/local/lib/libodbc.so.1
        libc_r.so.4 => /usr/lib/libc_r.so.4
        libcrypt.so.2 => /usr/lib/libcrypt.so.2
        libc.so.4 => /usr/lib/libc.so.4 
        libiconv.so.3 => /usr/local/lib/libiconv.so.3

Any insight on what may be causing it, or what needs to be done differently
would be greatly appreciated.

Thank you,

More information about the Snort-users mailing list