[Snort-users] Snort 2.0.0 logging to MySQL, but nothing in ACID???

Williams Jon WilliamsJonathan at ...2134...
Tue Oct 19 13:33:02 EDT 2004


I'm having a pretty bad brain fart.  Some time this morning, one of our
ACID consoles stopped working.  We've confirmed that all of our sensors
are seeing data and generating alerts, that the MySQL port is open
between all of the sensors and the DB server, that MySQL is running and
accepting connections on the port the sensors are connecting to, and
that the sensors are writing data to the database.

When I go into ACID, it shows no alerts and no sensors, but if I click
on the "Application cache and status" link, the Alert Information Cache
section shows the correct number of alerts under "Total Events".
Clicking on "Repair Tables" and "Update Alert Cache" have no effect on
the problem, nor did restarting the web server, MySQL server, and
rebooting the box.

Fortunately, we've got a second DB server.  When we repointed the
sensors to the second server, everything works fine there.

While I was logged into the box around the time that the problem
occurred, and there were no other users logged in at all since before
the problem, I have no clear recollection of any actions that had
anything to do with PHP, the web server, ACID, or MySQL.

Any suggestions?  Any idea how I shot myself in the foot?

Thanks.

Jon





More information about the Snort-users mailing list