[Snort-users] Snort not connecting to MySQL

Michael J. Ayers ayersmj at ...8009...
Wed Jan 15 11:27:04 EST 2003

Snort is on a different box than mysql and it has the client and shared
libraries and whatnot installed.  I can manually connect to the mysql
server from the snort box and view the database (there is nothing in it
tho).  So it isnt that it cant communicate with mysql...the problem is
that its not even trying (or i cant even tell if it is trying).  After
watching a tcpdump session on the mysql box and manually connecting i
got a bunch of data, but when i disconnected from the manual
session...tcpdump got really quiet.

On Wed, 2003-01-15 at 11:16, SecurityAdmin at ...7345... wrote:
> You shouldn't need to define a port. 3306 is default and it will just use
> that. Is snort on a different box from mysql? If snort is on a different box
> you need to install the MYSQL client on the snort box (not the server)
> You can also change the word "log" to "alert" if you want.
> What platform are you using?
> -----Original Message-----
> From: Michael J. Ayers [mailto:ayersmj at ...8009...] 
> Sent: Wednesday, January 15, 2003 11:37 AM
> To: snort-users at lists.sourceforge.net
> Subject: [Snort-users] Snort not connecting to MySQL
> I have snort installed and working for the most part...but the only
> thing that is not working is it is not connecting to the mysql database
> to update it.  I have verified that the host running snort CAN access
> the database...it just seems that snort isn't.  I have quadruple checked
> the following and it is correct:
> output database: log, mysql, user=snort password=snort dbname=snort
> host= port=3306
> Can anyone give me a heads up on how to figure out what is going on here
> that it is not connecting or how to turn on mysql logging?
> Thanks.
Michael J. Ayers
IT Manager
Eidogen Inc.
ayersmj at ...8009...

This e-mail message is for the sole use of the intended recipient(s) and
may contain confidential information. Any review, use, disclosure or
distribution by persons or entities other than the intended recipient(s)
is prohibited.  If you are not the intended recipient or have any
questions concerning whether or not you  should be receiving this
disclosure, please contact the sender  by reply and destroy all copies
of the original message. Thank you.

More information about the Snort-users mailing list