[Snort-users] MySQL Disconnects

This is a multipart message in MIME format.
--=_alternative 005F8C6588256DEA_=
Content-Type: text/plain; charset="us-ascii"

I have 2 sensors running at remote locations where bandwidth isn't exactly
the best. It looks like snort is losing connection to my MySQL server
accross the link. I have 1 other sensor in the exact same scenario and it
never loses connection. I'm determining this by running netstat on the
remote box and seeing only my ssh connection. If I restart snort, I see a
connection on port 3306 to my MySQL server.

Does anyone know why this is happening? My guess would be a timeout
somewhere but I would hope that snort would re-establish the connection if
it needs to. I know that these sensors are getting alerts but aren't able
to send them to the db because of the disconnect.

Any help is greatly appreciated.

Adam Peterson | Senior WAN Engineer | SPL WorldGroup |
adam_peterson@splwg.com
--=_alternative 005F8C6588256DEA_=
Content-Type: text/html; charset="us-ascii"


<br><font size=2 face="sans-serif">I have 2 sensors running at remote locations where bandwidth isn't exactly the best. &nbsp;It looks like snort is losing connection to my MySQL server accross the link. &nbsp;I have 1 other sensor in the exact same scenario and it never loses connection. &nbsp;I'm determining this by running netstat on the remote box and seeing only my ssh connection. &nbsp;If I restart snort, I see a connection on port 3306 to my MySQL server.</font>
<br>
<br><font size=2 face="sans-serif">Does anyone know why this is happening? &nbsp;My guess would be a timeout somewhere but I would hope that snort would re-establish the connection if it needs to. &nbsp;I know that these sensors are getting alerts but aren't able to send them to the db because of the disconnect.</font>
<br>
<br><font size=2 face="sans-serif">Any help is greatly appreciated.<br>
<br>
Adam Peterson | Senior WAN Engineer | SPL WorldGroup | adam_peterson@splwg.com</font>
--=_alternative 005F8C6588256DEA_=--


-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive? Does it
help you create better code? SHARE THE LOVE, and help us help
YOU! Click Here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users