[Snort-users] snort loosing connection to Mysql

Dirk Geschke Dirk_Geschke at ...1344...
Thu May 11 05:28:03 EDT 2006


Hi,

> I have just upgraded my snort binary to 2.4.4, which is logging to a remote
> Mysql Database.
> For patching reasons, the Mysql host is being rebooted every week and before
> the upgrade the snort binary would re-conenct to the DB without any
> problems, once the box was back up and running.

probably you changed the version of the MySQL database. The old behaviour
(MySQL 4.x) did automatically a reconnect whereas this is disabled with
the newer versions.

But just for this reason I would choose another way to insert the alerts
in the database, there are several solutions available and you will not
loose any alert during the database is rebooted. (And it is even better
for the performance, the database access via the output plugin slows 
down snort and you may miss some packets...)

Best regards

Dirk Geschke

BTW: Are you living in world far away? Or why shows the email a date of 
Thu, 20 Apr 2006 07:37:20 +0100 and the email arrives here at a date of
Wed, 10 May 2006 23:44:00 +0200? Three weeks for delivery?





More information about the Snort-users mailing list