[Snort-users] mysql database "gone away"

cconn at ...14171... cconn at ...14171...
Tue Jul 17 16:27:57 EDT 2007


Dirk,

I have used mysql output directly from snort, as well as barnyard.  As you
mentioned, snort will sometimes lose connectivity to the mysql DB.  This doesn't
just happen during a network outage either.  There's a bunch of ways you could
script a solution for this.  You could have a cron entry which runs every N
minutes and does a netstat to make sure the connection to the SQL server is
present, if not, it kills and restarts the snort process.  Same thing happens
with barnyard.

Chuck





More information about the Snort-users mailing list