[Snort-users] Question about Snort/ACID/MySQL and how they pl ay together

L. Christopher Luther CLuther at ...6333...
Wed Apr 23 11:26:02 EDT 2003


The '-A' command line parameter will override any output plugins you specify
in snort.conf.  Drop the '-A' command line parameter, and add the following
to snort.conf (assuming you still want alerts to a text file):  

    output alert_fast: alert.ids

Or whatever file name you want alerts written to.  

Also, you don't need to both log and alert to MySQL [0].  


- Christopher 

[0] http://www.theadamsfamily.net/~erek/snort/logging_methods.txt


-----Original Message-----
From: Snow Jacob C KPWA [mailto:JacobSC at ...160...]
Sent: Wednesday, April 23, 2003 1:48 PM
To: 'snort-users at lists.sourceforge.net'; 'Michael Steele'
Subject: [Snort-users] Question about Snort/ACID/MySQL and how they play
together


Just a curious question when you have:

output database: log, mysql, user=snort1 password=test_snort dbname=snort
host=xxx.xxx.xxx.xxx port=3306 sensor_name=slave1
output database: alert, mysql, user=snort1 password=test_snort dbname=snort
host=xxx.xxx.xxx.xxx port=3306 sensor_name=slave1

in the snort.conf file will you get alerts in the log file as well?

I have installed the service with:

snort /service /install -o -A fast -l d:/applications/snort/log -c
d:/applications/snort/etc/snort.conf -d -i3

when I run this from the command prompt (minus the /service and /install and
with the output line removed in snort.conf) it works well and gives me
alerts and all is well with the world, but when I add the output lines back
in hoping to get it to log the alerts to a database, I get no alerts in the
database, but I do get them in the log folder.  I have checked to make sure
I am getting a connection to the database with: telnet <databse comp name>
3306 and get the funny line of characters and such (aka doesn't puke).  

I am wondering why none of my alerts are going to the database, but are
instead going to the log folder?  Anyone have any ideas or do you need more
information or anything.



Thank you,

Jacob Snow
jacobsc at ...160...
(360)315-3487
NAVSEA Intern




More information about the Snort-users mailing list