[Snort-users] Barnyard2 problems with reputation preproc rules

Dave Corsello snort-users at ...15598...
Mon Feb 10 07:46:54 EST 2014


On 2/9/2014 10:35 AM, beenph wrote:
> Now you said it "crashed" mabey having the log would help explain and
> this is something you
> need to understand. It will generally exit gracefully with a error
> detail because if it would really
> crash, you wouln't have output to explain what is happening :)
> So having those messages can help.
Yes, sorry.  Crash was the wrong word.  I got an "ERROR inserting new
signature" followed by "FATAL ERROR: [dbProcessSignatureInformation()]:
Failed, stoping processing" followed by a respawn.  Between the two
Snort systems, this is the only insert error that I've gotten since
upgrading my database server.
> While you created that new database, did you ensure it was running
> InnoDB as storage engine? (should be but you never know)
Yes.  In fact on this system, the acid tables were also created as
InnoDB, whereas on the old system they were MyISAM.  Maybe this
contributes to the decreased insert errors?  But the errors have all
occurred on main tables, not acid tables.
> Also technically you shouldn't need to update your client libraries
> and recompile against them, you could either just update them if you
> feel's like it
> but they should replace the old library and since they are shared lib,
> you do not need to recompile unless you statically linked them
> into your previous build (which i doubt) then yes you would need to
> recompile for change to take effect.
I'll try updating them.




More information about the Snort-users mailing list