[Snort-users] Errors with simultaneous outputs in database

Muad Dib bizou31 at ...1855...
Wed Jun 22 10:12:21 EDT 2005


Hi all,

I used to using BASE + Snort 2.3.3 with a postgres sql
output 

Everything worked fine

But yesterday, i used my master-snort-box to build
snort-box-children and then problems begun.

Some snort-boxes are placed before and after some
firewalls ( say s1 before and s2 after)

In the case an alert is received from s1 and then from
s2, (time delay is very short : <1ms ) it seems to
create a bug in the database :

Here is what snort says :
Jun 22 11:44:14 s3 snort: database: warning (SELECT
sig_id   FROM signature  WHERE sig_name = 'SNMP
missing community string attempt'    AND sig_rev = 4  
 AND sig_sid = 1893 ) returned more than one result 
Jun 22 11:44:14 s3 snort: database: warning (SELECT
sig_class_id   FROM sig_class  WHERE sig_class_name =
'misc-attack') returned more than one result 
Jun 22 11:44:14 s3 snort: database: warning (SELECT
sig_class_id   FROM sig_class  WHERE sig_class_name =
'misc-attack') returned more than one result 
Jun 22 11:44:14 s3 snort: database: unable to write
classification 
Jun 22 11:44:14 s3 snort: database: warning (SELECT
sig_id   FROM signature  WHERE sig_name = 'SNMP
missing community string attempt'    AND sig_rev = 4  
 AND sig_sid = 1893 ) returned more than one result 
Jun 22 11:44:14 s3 snort: database: Problem inserting
a new signature 'SNMP missing community string
attempt' 
Jun 22 11:44:14 s3 snort: database: warning (SELECT
ref_id   FROM reference  WHERE ref_system_id = 2   
AND ref_tag = '1999-0517') returned more than one
result 
Jun 22 11:44:14 s3 snort: database: warning (SELECT
ref_id   FROM reference  WHERE ref_system_id = 2   
AND ref_tag = '1999-0517') returned more than one
result 
Jun 22 11:44:14 s3 snort: database: Unable to insert
the alert reference into the DB 
Jun 22 11:44:14 s3 snort: database: postgresql_error:
ERROR:  duplicate key violates unique constraint
"sig_reference_pkey"  
Jun 22 11:44:14 s3 snort: database: postgresql_error:
ERROR:  current transaction is aborted, commands
ignored until end of transaction block  
Jun 22 11:44:14 s3 snort: database: Unable to insert
unknown reference tag ('2112') used in rule. 
Jun 22 11:44:14 s3 snort: database: postgresql_error:
ERROR:  current transaction is aborted, commands
ignored until end of transaction block  

The other snort is saying the same thing.

And as a matter of fact, in the table signature for
instance, i can see several entries for 
:SELECT sig_id   
:FROM signature  
:WHERE sig_name = 'SNMP missing community string at
:tempt'    
:AND sig_rev = 4    
:AND sig_sid = 1893
I should have only one there

I've checked the spo_database.c from snort but as i'm
not a C addicted, i did not found error

The postgres logs confirms this bug :
ERROR:  duplicate key violates unique constraint
"sig_reference_pkey"
ERROR:  duplicate key violates unique constraint
"sig_reference_pkey"
ERROR:  current transaction is aborted, commands
ignored until end of transaction block
ERROR:  current transaction is aborted, commands
ignored until end of transaction block
ERROR:  current transaction is aborted, commands
ignored until end of transaction block
ERROR:  current transaction is aborted, commands
ignored until end of transaction block
ERROR:  current transaction is aborted, commands
ignored until end of transaction block
ERROR:  current transaction is aborted, commands
ignored until end of transaction block

I've already checked similar subjects on mailing
lists, but none helped

Each sensor is running in daemon mode
Each sensor is configured with a different sensor_name
in the output
All sensors have the same rules revision
Base scheme is built from create_postgresql from snort
sources
I've tried to purge the DB scheme and recreate this.
It works until i have only s1 running. When s2 is
running, it does not take long to generate errors

If a snort guru could have a look , i would be very
grateful since i'm in a real hurry to have this
project working.

Thanks for reading


	

	
		
___________________________________________________________________________ 
Appel audio GRATUIT partout dans le monde avec le nouveau Yahoo! Messenger 
Téléchargez cette version sur http://fr.messenger.yahoo.com




More information about the Snort-users mailing list