[Snort-users] Oracle output
Esler, Joel - Contractor
joel.esler at ...9426...
Tue Nov 23 13:37:08 EST 2004
We have discovered a problem with the Oracle output processor when
encoding is ASCII. (We have not tried hex)
However, in the oracle database since the data_payload is stored as a
"BLOB" the following change must be made.
# diff spo_database2.c spo_database.c
< "VALUES ('%u','%u','%s",
< strcat(query->val, "')");
> strcat(query->val, "'))");
We have discovered a lot of other problems too when two Snort boxes log
to the same DB. We're working this issue out. More to follow
Joel Esler, GCIA
More information about the Snort-users