[Snort-users] Barnyard not inserting on ACID tables in MySQL, just regular snort ones

Pedro Fortuna pedro.fortuna at ...11827...
Wed Sep 1 11:07:27 EDT 2004


You're right! Thanks Dirk! Acid tables are only populated by Acid
itself. I've just double checked the mysqld log.

I managed to get snort-barnyard-acid working. I told barnyard to log
to the old mysql DB (the one that snort was inserting directly, prior
to this setup), changed acid to work with the old DB, and it begun
working... why ? I don't know... I don't have any clue...

Both old and newest DBs were created like this: 
- created blank database,
- create snort mysql user
- Give permissions to user,
- snort's "contrib/create_mysql" script, 
- contrib/snortdb-extra.gz, 
- and finally the acid tables are created by Acid (setup option).

Anyway, now its working with the old DB, but two things are bodering me:
- ACID isn't showing my custom rule's description, it just shows
something like this in the alert "Snort Alert [1:1000002:0]" (1000002
is the rule ID)
- The events time are one our late! An event at 3am shows 2am.

If someone has a clue why Acid failed to insert the events in its tables 
(_using_ the blank DB) please say something, so that I can test it.

Pedro Fortuna

On Wed, 01 Sep 2004 09:44:20 +0200, Dirk Geschke <dirk_geschke at ...1344...> wrote:
> Hi Pedro,
> > I don't know why, but barnyard is not inserting on ACID tables in
> > MySQL, and ACID does not show any alert.
> >
> > I'm pretty sure of:
> > - snort is logging alerts correctly to unified log files
> > - barnyard is being able to read them and...
> > - ... it is connecting to mysql correctly and....
> > - it is inserting only on tables event,iphdr,tcphdr,data
> >
> > Don't know why:
> > - barnyard is not inserting on acid specific tables (it must be
> > because of this that ACID does not shows anything!)
> that is easy to explain: Only ACID fills the acid tables...
> The acid output plugin of barnyard is used to fill the database
> scheme which is used by acid. The acid tables are extensions made
> by acid to the database and is mainly used for caching or building
> up alert groups within acid.
> So don't blame barnyard for this...
> Best regards
> Dirk

More information about the Snort-users mailing list