[Snort-users] Acid shows sensors as 0

Gentian Hila gentianhila at ...11827...
Tue Nov 23 12:23:01 EST 2004


The line that configures snort to connect in snort.conf is uncommented
and is like this:

output database: log, mysql, user=snort password=******
 dbname=snort host=localhost

(******  is the password) and snort connects as snort user in Mysql
and db name in mysql is snort.

I have an empty event table.

mysql> select * from event;
Empty set (0.00 sec)

My question is: when you setup snort and acid, is it supposed to work
normally or do you have to configure other stuff and rules. My guess
is that it should work, even though it might need to be tuned. But
that's another story.

Thank you



On Tue, 23 Nov 2004 15:10:26 -0500, Kevin Johnson
<kjohnson at ...12400...> wrote:
> On Tue, 2004-11-23 at 14:50, Gentian Hila wrote:
> > Does it mean that is connecting ok ? I guess so ?
> > What table is that snort saves the data ?
> >
> > Thank you very much :)
> 
> Hi-
> 
> Yes that would mean that Snort is connecting, now we need to figure out
> whether it is actually alerting to the database.
> 
> What is the line that you have set up in snort.conf to alert?
> 
> i.e.
> 
> output database: log, mysql, user=username password=passwd
> dbname=snort_log host=localhost
> Is this uncommented?  Also how many rows are in your event table?
> 
> Kevin
> 
> 
> -------------------
> BASE Project Lead
> http://sourceforge.net/projects/secureideas
> http://base.secureideas.net
> The next step in IDS analysis!
> 
> 
>




More information about the Snort-users mailing list