[Snort-users] snort unable to log alert to database mysql

Joel Esler jesler at ...1935...
Sun Dec 2 11:40:26 EST 2012


No. We didn't fail to remove it. When it was removed, it was removed. We've been asking people not to use it forever. 

--
Joel Esler
Sent from my iPad 

On Dec 2, 2012, at 11:05 AM, "Michael Steele" <michaels at ...9077...> wrote:

> I think the problem might be that Sourcefire failed to remove the database output option in some of the Snort releases after the option had been deprecated leaving users, especially new users, with the assumption that Snort would handle database output.
>  
> It seems to me Snort could display a more descriptive error message when the ‘database’ output plugin option has been detected in the snort.conf.
>  
> I think users can look at Banyard2 the same way as they have database options listed in the configuration file that are not supported.
>  
> Michael...
>  
> WINSNORT.com Management Team
>  
> --
> ****************** Established ~ 2001 *******************
> *          Visit Us @ http://www.winsnort.com           *
> *      ~~ FREE WinIDS Snort installation guides ~~      *
> *               ~~ FREE support forums ~~               *
> * Snort: Open Source Network IDS - http://www.snort.org *
> *********************************************************
>  
> From: Y M [mailto:snort at ...15979...] 
> Sent: Sunday, December 02, 2012 8:58 AM
> To: TermVRL M; Snort User (snort-users at lists.sourceforge.net); snort-users-request at lists.sourceforge.net
> Subject: Re: [Snort-users] snort unable to log alert to database mysql
>  
> Which version of snort are you using?
> 
> At my best knowledge, snort's own database output plugin is deprecated since 2.9.3.x.
> 
> In that case, you will have to use barnyard2 to get alerts into the database.
> 
> YM
> From: TermVRL M
> Sent: 12/2/2012 4:42 PM
> To: Snort User (snort-users at lists.sourceforge.net); snort-users-request at ...2902...ists.sourceforge.net
> Subject: [Snort-users] snort unable to log alert to database mysql
> 
> Hi all,
> 
> i get this error when try to log snort output to database..
> 
> ERROR: /usr/local/snort/etc/snort.conf(535) Unknown output plugin: "database"
> 
> ------------------------------------------------------------------------------
> Keep yourself connected to Go Parallel: 
> DESIGN Expert tips on starting your parallel project right.
> http://goparallel.sourceforge.net/
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> 
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20121202/f5721a80/attachment.html>


More information about the Snort-users mailing list