[Snort-users] Problem when adding snort s

Anthony Liberty Thony at ...5579...
Wed Jan 15 17:05:14 EST 2003


thanks , jhon.

my snort has run now .
btw, what is the minimum requirement for snortcenter. coz when i generate
the report with acid , i've to wait quite too long.
my snortcenter is PIII-800,128Mb,20 GB,512Swap.

rgrds,
--thony-- 

-----Original Message-----
From: Hicks, John [mailto:JHicks at ...5857...]
Sent: 16 Januari 2003 1:24
To: 'Anthony Liberty'
Subject: RE: RE: [Snort-users] Problem when adding snort s


The DB output options are found in the snort.conf [1]

hth,
John

[1]http://www.snort.org/docs/writing_rules/chap2.html#tth_sEc2.5.8

-----Original Message-----
From: Anthony Liberty [mailto:Thony at ...5579...]
Sent: Monday, January 13, 2003 9:52 PM
To: 'larc'
Cc: 'snort-users at lists.sourceforge.net'
Subject: RE: RE: [Snort-users] Problem when adding snort s
Importance: High


Hi larc,

when i add the sensor, and do not active output plugins , snort can run , 
but if i activate output plugins , snort can't run , here is the sensor
message below:

++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
Initializing Preprocessors!
Initializing Plug-ins!
database: mysql_error: Can't connect to MySQL server on 'x.x.x.243' 
(113)
Fatal Error, Quitting..
database: compiled support for ( mysql )
database: configured to use mysql
++++++++++++++++++++++++++++++++++++++++++++++++++

MySQL server suppose to be in x.x.x.241 , what file should I edit to change
the conf , so that it knows where to connect to MySQL Server.


thanks,
--thony--





-----Original Message-----
From: larc [mailto:larc at ...1187...]
Sent: 13 Januari 2003 16:57
To: Anthony Liberty
Subject: Re: RE: [Snort-users] Problem when adding snort s


Hi,

You are wrong that you don't use curl, probably it's already installed by
default on your system.
If the mgmt can connect, did you activate vars, rules, ... for that sensor?
Did you first push the configuration to the sensor before you try to start
it?
What is the sensor message when you click 'start'?

If this is the first time that you use snortcenter, then you maybe can start
already with the new beta version. It will do a lot more automaticly for u.
If you want to use it, then first drop the snortcenter database and create a
fresh one.

regards,
Stefan

------------------------
 Anthony Liberty <Thony at ...5579...> wrote:
------------------------
hi larc,
>
>the management has connect to the sensor now , but i'm still can't start
the
>sensor agent.
>
>no , i don't use curl and do not use ssl connection between the management
>to the sensor agent.
>yes , i have set the same port .
>no , i can't surf to the sensor , but i can surf to the management to add
>and monitor the sensor. am i right ?
>I am using snortcenter-agent v.0.1.6
>and snort mgmt v 0.9.6
>
>thanks,
>--thony--
>
>
>-----Original Message-----
>From: larc [mailto:larc at ...1187...]
>Sent: 13 Januari 2003 16:28
>To: Anthony Liberty; snort-users at lists.sourceforge.net
>Subject: Re: [Snort-users] Problem when adding snort sensor
>
>
>Hi,
>
>What is the error in the sensor message box?
>Do you have curl installed on the management console?
>Is curl compiled with ssl (if you are using ssl on the agent)?
>Did you enter the same port number on mgmt & agent?
>Can you surf with your browser to the sensor?
>What version of agent & mgmt are u using?
>
>Hope this helps,
>Stefan D.
>
>------------------------
> Anthony Liberty  wrote:
>------------------------
>hi Snort user,
>>
>>i'm having a problem when adding snort sensor to snort console on
>>SnortCenter.
>>the message shown is " can't connect to 172.16.x.x Retry connecting"
>>
>>please pointing me.
>>
>>thanks
>>--thony--
>>
>>
>>-------------------------------------------------------
>>This SF.NET email is sponsored by:
>>SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
>>http://www.vasoftware.com
>>_______________________________________________
>>Snort-users mailing list
>>Snort-users at lists.sourceforge.net
>>Go to this URL to change user options or unsubscribe:
>>https://lists.sourceforge.net/lists/listinfo/snort-users
>>Snort-users list archive:
>>http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>
>
>-------------------------------------------------------
>This SF.NET email is sponsored by: FREE  SSL Guide from Thawte
>are you planning your Web Server Security? Click here to get a FREE
>Thawte SSL guide and find the answers to all your  SSL security issues.
>http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0026en
>_______________________________________________
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/listinfo/snort-users
>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This SF.NET email is sponsored by: FREE  SSL Guide from Thawte
are you planning your Web Server Security? Click here to get a FREE
Thawte SSL guide and find the answers to all your  SSL security issues.
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0026en
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users




More information about the Snort-users mailing list