[Snort-users] snort and mysql5 losing db connection

Greg King j.greg.k at ...11827...
Thu Jun 14 08:24:03 EDT 2007


I posted this on the forums a few days ago but since there has been no
replies I am asking anyone on this list for assistance.


Most of my sensors are running on centos 4 without a problem using mysql and
base. To start getting familiar with CentOS 5 i built a test sensor which
comes with mysql 5. I compiled the latest snort 2.6.x version.

What happens if I do not get any alarms is snort loses the connection and
starts throwing various errors like

snort[7890]: database: mysql_error: MySQL server has gone away

The database is working fine. I can still connect to it.

Googling, the only explanation with a possible fix I found was at

http://www.uno-code.com/?q=node/81

Quoteing from the above link:

"The other issue that was extremely hard to track down was when a large gap
of time (usually 4-6 hours) between alerts occurred. At this time Snort
states that MySQL has gone away. It appears that Snort needs a persistent
connection to MySQL, and when a gap occurs that connection is lost or
'released' due to timeout, and Snort doesn't initiate a new connection to
MySQL."

Any ideas on how to deal with this instead of setting the wait_timeout =
10000000 in my.cnf? Another thread back in 2005 mentioned to use barnyard
and not the sql connector. That is not an option for base and probably would
fail with aanval users as well. I could simply go back to centos4 but that
just delays the issue instead of fixing it.

thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20070614/4be1cf22/attachment.html>


More information about the Snort-users mailing list