[Snort-users] Snort, mysql and sockets

_ 0kita goo13c at ...125...
Tue Nov 4 11:52:09 EST 2003

So here's the error message...

ERROR: database: mysql_error: Can't connect to local MySQL server through 
socket '/var/run/mysql/mysql.sock' (2)
Fatal Error, Quitting..

I'm running snort into a mysql database on OpenBSD 3.3

The problem I'm facing is that the mysql client installed as a package into 
OpenBSD 3.3 has the /var/run/mysql/mysql.sock compiled into the binary as a 
default.  I'm using the global /etc/my.cnf to change both the server and the 
client to a different socket.
However, when snort is dumping data into the mysql database, it doesn't 
allow the mysql binary access to the my.cnf, and instead feeds all the 
required information as switches in the snort.conf
I've looked through the spo_database.c and it seems like there should just 
be the addition of a socket variable (just like the port, or hostname).  
Either that, or use of the my.cnf file for everything but the username, 
password and dbname.
Now, it's an easy fix to create a soft link from the existing socket to 
where it expects it.  Or I could recompile mysql to point to the different 
socket by default.  However, mysql takes numerous switches, and it seems 
like more of them should be accepted by snort in the snort.conf
Could someone fire together a diff, or suggest a solution?

G 0kita

Add photos to your e-mail with MSN 8. Get 2 months FREE*.  

More information about the Snort-users mailing list