[Snort-users] Barnyard not inserting on ACID tables in MySQL, just regular snort ones
Alex Butcher, ISC/ISYS
Alex.Butcher at ...11254...
Thu Sep 2 03:07:09 EDT 2004
--On 01 September 2004 19:06 +0100 Pedro Fortuna <pedro.fortuna at ...11827...>
> Anyway, now its working with the old DB, but two things are bodering me:
> - ACID isn't showing my custom rule's description, it just shows
> something like this in the alert "Snort Alert [1:1000002:0]" (1000002
> is the rule ID)
I had this problem when I was using mudpit, and mudpit couldn't find
sid-msg.map and gen-msg.map. I haven't used barnyard, and I'm using FLoP
now, but maybe your problem has the same root.
> - The events time are one our late! An event at 3am shows 2am.
Probably a timezone or daylight savings time thing; I think all events are
logged as UTC (i.e. GMT+0). Are you in western Europe, by chance?
> If someone has a clue why Acid failed to insert the events in its tables
> (_using_ the blank DB) please say something, so that I can test it.
Did you run create_acid_tbls_mysql.sql from the ACID distribution?
> Pedro Fortuna
Alex Butcher: Security & Integrity, Personal Computer Systems Group
Information Systems and Computing GPG Key ID: F9B27DC9
GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9
More information about the Snort-users