[Snort-users] Barnyard not inserting on ACID tables in MySQL, just regular snort ones

Alex Butcher, ISC/ISYS Alex.Butcher at ...11254...
Thu Sep 2 03:07:09 EDT 2004


--On 01 September 2004 19:06 +0100 Pedro Fortuna <pedro.fortuna at ...11827...> 
wrote:

> Anyway, now its working with the old DB, but two things are bodering me:
> - ACID isn't showing my custom rule's description, it just shows
> something like this in the alert "Snort Alert [1:1000002:0]" (1000002
> is the rule ID)

I had this problem when I was using mudpit, and mudpit couldn't find 
sid-msg.map and gen-msg.map. I haven't used barnyard, and I'm using FLoP 
now, but maybe your problem has the same root.

> - The events time are one our late! An event at 3am shows 2am.

Probably a timezone or daylight savings time thing; I think all events are 
logged as UTC (i.e. GMT+0). Are you in western Europe, by chance?

> If someone has a clue why Acid failed to insert the events in its tables
> (_using_ the blank DB) please say something, so that I can test it.

Did you run create_acid_tbls_mysql.sql from the ACID distribution?

> Thanks,
> Pedro Fortuna

HTH,
Alex.
-- 
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing             GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9






More information about the Snort-users mailing list