[Snort-users] MYSQL Error

Paul Schmehl pauls at ...6838...
Sat Dec 20 10:30:01 EST 2003


--On Friday, December 19, 2003 16:50:07 -0700 Dan Ferris <dferris at ...9997...> 
wrote:

> Has anyone found the cause of this type of problem yet:
>
> Dec 19 16:42:49 napoleon snort: database: mysql_error: Duplicate entry
> '1-48' for key 1 SQL=INSERT INTO event (sid,cid,signature,timestamp)
> VALUES ('1', '48', '9', '2003-12-19 16:42:49-07')
>
At the risk of sounding trite, it's caused by duplicate processes trying to 
write to the database.  For example, you've started snort twice, so you 
have two processes running with the same snort.conf file and startup 
parameters.  Or you haven't specified the sensor_name in your output plugin 
configuration, you have two copies of snort running and it's defaulting to 
the same sensor_name for both processes.

In short, two things are trying to write the same *identical* information 
to the database.

Paul Schmehl (pauls at ...6838...)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu




More information about the Snort-users mailing list