[Snort-users] Snort Test Error
mike at ...7385...
Thu Jan 2 11:17:40 EST 2003
Thanks.. I just fixed the issue... basically, I had to delete the SNORT
database, reload everything,then restart MySQL.
I actually did this once, however I did't have any luck that time around.
Thanks again for your help.
From: Michael Steele [mailto:michaels at ...155...]
Sent: Thursday, January 02, 2003 10:39 AM
To: 'Mike Koponick'; snort-users at lists.sourceforge.net
Subject: RE: [Snort-users] Snort Test Error
Garb the correct create_mysql script. You may need to download the same
version of Snort that you are running to be sure you have the correct
Michael Steele | System Engineer / Support Technician
mailto:michaels at ...155...
Silicon Defense: IDS solutions - http://www.silicondefense.com
Snort: Open Source Network IDS - http://www.snort.org
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Mike Koponick
Sent: Thursday, January 02, 2003 8:44 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Snort Test Error
I hope everyone had a good New Year's.. now it's time to get some work done
I'm have an issue with SNORT. Over the holidays, the ACID database became
corupt somehow. So, I deleted the database, (I wasn't able to repait it) and
installed a new one, with the same files as the original.
Now, SNORT will not start. When testing it, I get the following output:
Testing Snort's ConfgurationInitializing Output Plugins!
Log directory = /var/log/snort
Initializing Network Interface eth1
WARNING: OpenPcap() device eth1 network lookup:
eth1: no IPv4 address assigned
--== Initializing Snort ==--
Decoding Ethernet on interface eth1
Parsing Rules file /etc/snort/snort.conf
Initializing rule chains...
No arguments to frag2 directive, setting defaults to:
Fragment timeout: 60 seconds
Fragment memory cap: 4194304 bytes
Fragment min_ttl: 0
Fragment ttl_limit: 5
Fragment Problems: 0
Stateful inspection: ACTIVE
Session statistics: INACTIVE
Session timeout: 30 seconds
Session memory cap: 8388608 bytes
State alerts: INACTIVE
Evasion alerts: INACTIVE
Scan alerts: ACTIVE
Log Flushed Streams: INACTIVE
TTL Limit: 5
Async Link: 0
*WARNING*: unknown preprocessor "stream4_reassemble, ports all", ignoring!
IIS alternate Unicode decoding
IIS double encoding vuln
Flip backslash to slash
Include additional whitespace separators
Ports to decode http on: 80
Ports to decode RPC on: 111 32771
Ports to decode telnet on: 21 23 25 119
Using LOCAL time
Conv Count: 32000
Timeout : 60
Alert Odd?: 1
Allowed IP Protocols:
WARNING => [Alert_FWsam](FWsamCheckIn) Could not connect to host
192.168.xx.xx. Will try later.
database: compiled support for ( mysql )
database: configured to use mysql
database: user = snort
database: password is set
database: database name = snort
database: host = localhost
database: sensor name = snort:eth1
database: sensor id = 2
database: schema version = 0
database: The underlying database seems to be running an older version of
the DB schema (current version=0, required minimum version= 106).
If you have an existing database with events logged by a previous
version of snort, this database must first be upgraded to the
schema (see the snort-users mailing list archive or DB plugin
documention for details).
If migrating old data is not desired, merely create a new instance
of the snort database using the appropriate DB creation script
(e.g. create_mysql, create_postgresql, create_oracle,
located in the contrib\ directory.
See the database documentation for cursory details
and the URL to the most recent database plugin documentation.
Fatal Error, Quitting..
As far as I know, it's all the same files that I have been using in the
Anyone have any ideas?
Thanks in advance,
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:
More information about the Snort-users