[Snort-users] FW: Snort 2.8.6 & Snort Report 1.3.1 with "NoData..."

Jun Wan junwei_wan at ...125...
Fri Aug 27 06:32:07 EDT 2010


Hi Billy,
 
Thanks for help, I have solved the issue after I followed David's instructions, please see my another email.
 
in the installation guide something seems to be missing, you may be right (as you said they may fail to report try:
 mysql -usnort -p -D snort -e "select count(*) from event"), otherwise it should work by following the guide. 
 
My best experience with Snort was "Ubundu 9.1 + Snort 2.8.4.1+BASE" from bil at work: https://wwwx.cs.unc.edu/~hays/archives/2010/03/entry_23.php , it just worked in my first installation, which made me fall in love with Snort then.
 
Information would be useless if it is not organized, "Snort Report" and "BASE" organize network information in such a way which enable network engineers to see "things" clearly. 
 
Many thanks for you, David,Joel Esler and many other folks from this list, your guys made my "journey" much easier.
 
 
Regards
 
John


 

________________________________
> Date: Thu, 26 Aug 2010 07:51:23 -0600
> From: Billy.Marshall at ...9988...
> To: junwei_wan at ...125...; snort-users at lists.sourceforge.net
> Subject: Re: [Snort-users] FW: Snort 2.8.6 & Snort Report 1.3.1 with
> "NoData..."
>
> as far as the chown command, yes, it is a typo.
> However, file location is a matter of preference and where ever the
> config files live you need to match them with how snort/barnyard is
> invoked. This could be a startup script or within the .conf files
> themselves.
>
> On the note that they fail to report try:
> mysql -usnort -p -D snort -e "select count(*) from
> event"

> run this a few times if the database grows then either barnyard or
> snort is logging.
> Verify which by either commenting out
> output unified2: filename , limit 128 --- from
> snort.conf for barnyard logging
> or
> output database: log, mysql, user=snort password=> password> dbname=snort host=localhost --- from snort.conf for snort
> logging
>
> Last you may look in your log files where the alerts are kept to see if
> they are proper ownership. I have noticed if I run snort as a different
> user it creates an alert.xxx file with different ownership and when I
> start it with snort it gets hosed because of permissions. e.g make sure
> all log files for snort alerts are:
> chown snort:snort
>
>
>
> 		 	   		  



More information about the Snort-users mailing list