[Snort-users] Snort and MySQL

Patrick S. Harper patrick at ...4250...
Sun Aug 29 13:57:13 EDT 2004

Not if you have your conf file set up right.  The output database line has
that info.  

Patrick S. Harper | CISSP RHCT MCSE

www.ntsug.org - Snort Users Group

"If there is no light at the end of the tunnel, get down there and light the
damn thing yourself!"
-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Miikka
Sent: Sunday, August 29, 2004 1:49 PM
To: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Snort and MySQL

I might be totally off, but shouldn't you specify the MySQL username in the
command whe you start snort.
like ' snort -u snort -c /etc/snort/snort.conf '


Robert Spangler wrote:

>I seem to be having a problem setting up snort to use MySQL database.
>When I run 'snort -c /etc/snort/snort.conf'  I get the following:
>Running in IDS mode
>Log directory = /var/log/snort
>Initializing Network Interface eth0
>        --== Initializing Snort ==--
>Initializing Output Plugins!
>Decoding Ethernet on interface eth0
>Initializing Preprocessors!
>Initializing Plug-ins!
>Parsing Rules file /etc/snort/snort.conf
>Initializing rule chains...
>database: compiled support for ( MySQL )
>database: configured to use MySQL
>database:          user = snort
>database: database name = snort
>database:          host = localhost
>database:   sensor name =
>ERROR: database: MySQL_error: Access denied for user: 'snort at ...274...' 
>password: NO)
>Fatal Error, Quitting..
>snort.conf has the following entry:
>output database: log, MySQL, user=snort, password=******** dbname=snort 
>host=localhost ===================================================
>MySQL was setup using this line for snort:
>grant INSERT,SELECT on root.* to snort at ...274...; SET PASSWORD FOR 
>snort at ...274...=PASSOWRD('********');
>grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to snort at ...274...; 
>grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to snort; 
>This was a step by step guide I had followed to set this up.  I'm 
>hoping someone might be able to see what I'm missing.  Thnx

This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise
J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list