[Snort-users] No Activity Occurring on ACID

Paul Schmehl pauls at ...6838...
Fri Jul 23 07:40:49 EDT 2004


--On Friday, July 23, 2004 07:26:54 AM -0400 "Kaplan, Andrew H." 
<AHKAPLAN at ...10063...> wrote:

> I have MySQL installed on the system, and have configured the snort.conf
> file with the following line:
>
> output database: log, mysql, user=snort password=XXXXXX dbname=snort
> host=127.0.0.1 port=3306 sensor_name=rosnort
>
> Snort is started at boot time via the /etc/init.d/snort script.
> Additionally, I have started snort manually with
> the following command syntax:
>
> /usr/local/bin/snort -A full -i eth0 -c /etc/snort/snort.conf -v
>
What do you see in /var/log/messages when snort is started up?

> I did a check of the snort database to see if anything is being logged
> there. When I run the select count (*) from event;
> command I get 0 which would appear to indicate the data is not being
> posted into the database. If that is the case, does
> that mean there is a permissions issue at work here, or something else?
>
That's correct.  Nothing is being logged to the db.

> FYI: To access the mysql database I ran the following command:
> /usr/local/mysql/bin/mysql -p and provided the password.
>
Yes, but did you login to the db using the same *user* and pass that snort 
is trying to us?  mysql -u user -p

Note you can also run "snort -T" to run snort and test everything.  (It 
will use the conf file if it's in the default location.  Yours appears to 
be.)  This will print to stdout, so you can pipe it through less and read 
the output.

Paul Schmehl (pauls at ...6838...)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/




More information about the Snort-users mailing list