[Snort-users] MYSQL Error
pauls at ...6838...
Sat Dec 20 10:30:01 EST 2003
--On Friday, December 19, 2003 16:50:07 -0700 Dan Ferris <dferris at ...9997...>
> Has anyone found the cause of this type of problem yet:
> Dec 19 16:42:49 napoleon snort: database: mysql_error: Duplicate entry
> '1-48' for key 1 SQL=INSERT INTO event (sid,cid,signature,timestamp)
> VALUES ('1', '48', '9', '2003-12-19 16:42:49-07')
At the risk of sounding trite, it's caused by duplicate processes trying to
write to the database. For example, you've started snort twice, so you
have two processes running with the same snort.conf file and startup
parameters. Or you haven't specified the sensor_name in your output plugin
configuration, you have two copies of snort running and it's defaulting to
the same sensor_name for both processes.
In short, two things are trying to write the same *identical* information
to the database.
Paul Schmehl (pauls at ...6838...)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
More information about the Snort-users