[Snort-users] Snort upgrade/MySQL database problems

Hutchinson, Andrew andrew.hutchinson at ...759...
Mon Jul 7 11:07:16 EDT 2003

Hmm.  If you upgraded your schema during the 1.8 -> 1.9 move, you should
be running the 106 schema, which should have the last_cid entry in the
sensors table.

Can you run a "select * from schema" to make sure that you're running
106.  If you are, then run a "desc sensor" and see if it includes the
last_cid field.  If it does not, then run:


That should add that column with the correct datatype.  I'd still be
somewhat curious why it isn't there if the schema table says it's 106,


Andrew Hutchinson - Network Security
Vanderbilt University Medical Center
(615) 936-2856

> -----Original Message-----
> From: Marc Quibell [mailto:mquibell at ...7759...] 
> Sent: Monday, July 07, 2003 10:21 AM
> To: snort-users at ...382...
> Subject: [Snort-users] Snort upgrade/MySQL database problems
> I have two sensors installed. I just upgraded the OTHER 
> sensor to Snort 2.0. I
> previously upgrade a current system to 2.0 a month or so ago. 
> Now I am combining
> the two into the 1.9 MySQL database. I upgraded the schema 
> during my 1.8 > 1.9
> migration. Now when I bring my old Snort 2.0 in with the new 
> onto the MySQL
> database, i get the error:
> Jul  1 10:03:41 Security snort: database: mysql_error: 
> Unknown column 'last_cid'
>  in 'field list' SQL=INSERT INTO sensor (hostname, interface, detail,
> encoding, last_cid) VALUES ('Internal','eth1','1','0', '0')
> Jul  1 10:03:41 Security snort: database: Problem obtaining 
> SENSOR ID (sid) from
>  snortmasterdatabase->sensor
> Jul  1 10:03:41 Security snort: FATAL ERROR:   When this 
> plugin starts, a SELECT
>  query is run to find the sensor id for the  currently running sensor.
> If the sensor id is not found, the plugin will run  an INSERT 
> query to insert
> the proper data and generate a new sensor id. Then a  SELECT 
> query is run to
> get the newly allocated sensor id. If that fails then  this 
> error message is
> generated.   Some possible causes for this error are:
>  * the user does not have proper INSERT or SELECT privileges  
>  * the sensor
> table does not exist   If you are _absolutely_ certain that 
> you have the
> proper privileges set and  that your database structure is 
> built properly please
>  let me know if you  continue to get this error. You can contact me at
> (roman at ...438...).
> I checked and rechecked db rights on the new system, the user 
> has full rights to
>  the database. I've checked many resources, including snort 
> discussions, to no
> avail.
> The only thing I've found on this was an older bug. TIA!
> -------------------------------------------------------
> This SF.Net email sponsored by: Free pre-built ASP.NET sites including
> Data Reports, E-commerce, Portals, and Forums are available now.
> Download today and enter to win an XBOX or Visual Studio .NET.
> http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_06
> 1203_01/01
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

More information about the Snort-users mailing list