[Snort-users] Error In snort HELP!!!

permalink · #1 (**permalink**) 04-16-2004

This is a multi-part message in MIME format.

------_=_NextPart_001_01C423DD.8BC32A5D
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

I am having a problem getting the senor name from the MySQL database, I
have attached a view of the MySQL database.

=20

This is when starting snort l

'snort -d -l d:\ -c C:\Snort\etc\snort.conf'

=20

database: compiled support for ( mysql odbc )

database: configured to use mysql

database: user =3D snort

database: password is set

database: database name =3D snort

database: host =3D localhost

database: sensor name =3D DATADEV:\

database: mysql_error: Unknown column 'last_cid' in 'field list'

SQL=3DINSERT INTO sensor (hostname, interface, detail, encoding, =
last_cid)
VALUES

('DATADEV:\\','\\','1','0', '0')

database: Problem obtaining SENSOR ID (sid) from snort->sensor

ERROR:

When this plugin starts, a SELECT query is run to find the sensor id
for the

currently running sensor. If the sensor id is not found, the plugin
will run

an INSERT query to insert the proper data and generate a new sensor id.
Then a

SELECT query is run to get the newly allocated sensor id. If that fails
then

this error message is generated.

=20

Some possible causes for this error are:

* the user does not have proper INSERT or SELECT privileges

* the sensor table does not exist

=20

If you are _absolutely_ certain that you have the proper privileges set
and

that your database structure is built properly please let me know if
you

continue to get this error. You can contact me at (roman@danyliw.com).

=20

Fatal Error, Quitting..

=20

C:\Snort\bin>

=20

=20

Here is output from the MySql Database

=20

C:\mysql\bin>mysql

Welcome to the MySQL monitor. Commands end with ; or \g.

Your MySQL connection id is 28 to server version: 3.23.40-nt

=20

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

=20

mysql> USE SNORT

Database changed

mysql> SHOW TABLES;

+------------------+

| Tables_in_SNORT |

+------------------+

| acid_ag |

| acid_ag_alert |

| acid_event |

| acid_ip_cache |

| data |

| detail |

| encoding |

| event |

| icmphdr |

| iphdr |

| opt |

| reference |

| reference_system |

| schema |

| sensor |

| sig_class |

| sig_reference |

| signature |

| tcphdr |

| udphdr |

+------------------+

20 rows in set (0.01 sec)

=20

=20

mysql> SELECT * FROM sensor;

+-----+--------------------------------------------------------------+--
--------

-------------------------------------------+--------+--------+----------
+

| sid | hostname |
interface

| filter | detail | encoding
|

+-----+--------------------------------------------------------------+--
--------

-------------------------------------------+--------+--------+----------
+

| 1 | DATADEV:DevicePacket_{3250B567-F55D-4B8C-AEF4-14298A26FA3B}

| DevicePacket_{3250B567-F55D-4B8C-AEF4-14298A26FA3B} | NULL | 1
|

0 |

+-----+--------------------------------------------------------------+--
--------

-------------------------------------------+--------+--------+----------
+

1 row in set (0.00 sec)

=20

mysql> GRANT INSERT,SELECT on sensor to snort;

Query OK, 0 rows affected (0.00 sec)

=20

mysql>

=20

Thank you all

=20

=20

Cody Smith CCNA, MCP

Network Administrator

Cypress Software Systems

Phone: (817)514-6777x111

Csmith@go-cypress.com

=20

------_=_NextPart_001_01C423DD.8BC32A5D
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:st1=3D"urn:schemas-microsoft-com:office:smarttags" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<meta http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered medium)">
<o:SmartTagType =
namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"
name=3D"City"/>
<o:SmartTagType =
namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"
name=3D"place"/>

<style>

</style>

</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple>

<div class=3DSection1>

I am having a problem getting the senor name from the =
MySQL
database, I have attached a view of the MySQL =
database.<o:p></o:p>

<o:p> </o:p>

This is when starting snort =
l<o:p></o:p>

‘snort -d -l d:\ -c
C:\Snort\etc\snort.conf’<o:p></o:p></p=
>

<o:p> </o:p>

database: compiled support for ( mysql odbc =
)<o:p></o:p>

database: configured to use =
mysql<o:p></o:p>

database:    &nb sp;  &nb=
sp; 
user =3D snort<o:p></o:p>

database: password is =
set<o:p></o:p>

database: database name =3D =
snort<o:p></o:p>

database:    &nb sp;  &nb=
sp; 
host =3D localhost<o:p></o:p>

database:   sensor name =3D =
DATADEV:\<o:p></o:p>

database: mysql_error: Unknown column 'last_cid' in =
'field
list'<o:p></o:p>

SQL=3DINSERT INTO sensor (hostname, interface, =
detail,
encoding, last_cid) VALUES<o:p></o:p>

('DATADEV:\\','\\','1','0', =
'0')<o:p></o:p>

database: Problem obtaining SENSOR ID (sid) from
snort->sensor<o:p></o:p>

ERROR:<o:p></o:p>

 When this plugin starts, a SELECT query is run =
to find
the sensor id for the<o:p></o:p>

 currently running sensor. If the sensor id is =
not
found, the plugin will run<o:p></o:p>

 an INSERT query to insert the proper data and =
generate
a new sensor id. Then a<o:p></o:p>

 SELECT query is run to get the newly allocated =
sensor
id. If that fails then<o:p></o:p>

 this error message is =
generated.<o:p></o:p>

<o:p> </o:p>

 Some possible causes for this error =
are:<o:p></o:p>

  * the user does not have proper INSERT or =
SELECT
privileges<o:p></o:p>

  * the sensor table does not =
exist<o:p></o:p>

<o:p> </o:p>

 If you are _absolutely_ certain that you have =
the
proper privileges set and<o:p></o:p>

 that your database structure is built properly =
please
let me know if you<o:p></o:p>

 continue to get this error. You can contact me =
at
(roman@danyliw.com).<o:p></o:p>

<o:p> </o:p>

Fatal Error, Quitting..<o:p></o:p>

<o:p> </o:p>

C:\Snort\bin><o:p></o:p>

<o:p> </o:p>

<o:p> </o:p>

Here is output from the MySql =
Database<o:p></o:p>

<o:p> </o:p>

C:\mysql\bin>mysql<o:p></o:p>

Welcome to the MySQL monitor.  Commands end with =
; or
\g.<o:p></o:p>

Your MySQL connection id is 28 to server version: =
3.23.40-nt<o:p></o:p>

<o:p> </o:p>

Type 'help;' or '\h' for help. Type '\c' to clear the
buffer.<o:p></o:p>

<o:p> </o:p>

mysql> USE SNORT<o:p></o:p>

Database changed<o:p></o:p>

mysql> SHOW TABLES;<o:p></o:p>

+------------------+<o:p></o:p>

| Tables_in_SNORT  =
|<o:p></o:p>

+------------------+<o:p></o:p>

|
acid_ag       & nbsp;  =
|<o:p></o:p>

| acid_ag_alert    =
|<o:p></o:p>

| acid_event       =
|<o:p></o:p>

| acid_ip_cache    =
|<o:p></o:p>

|
data       &nbs p;   &nb=
sp; |<o:p></o:p>

|
detail       &n bsp;   =
|<o:p></o:p>

| =
encoding          =
|<o:p></o:p>

|
event       &nb sp;    =
|<o:p></o:p>

|
icmphdr       & nbsp;  =
|<o:p></o:p>

| =
iphdr       &nb sp;   
|<o:p></o:p>

|
opt       &nbsp ;   &nbs=
p; 
|<o:p></o:p>

| reference      &nbsp ; =
|<o:p></o:p>

| reference_system |<o:p></o:p>

|
schema       &n bsp;   =
|<o:p></o:p>

|
sensor       &n bsp;   =
|<o:p></o:p>

| sig_class      &nbsp ; =
|<o:p></o:p>

| sig_reference    =
|<o:p></o:p>

| signature      &nbsp ; =
|<o:p></o:p>

|
tcphdr       &n bsp;   =
|<o:p></o:p>

|
udphdr       &n bsp;   =
|<o:p></o:p>

+------------------+<o:p></o:p>

20 rows in set (0.01 =
sec)<o:p></o:p>

<o:p> </o:p>

<o:p> </o:p>

mysql> SELECT * FROM =
sensor;<o:p></o:p>

+-----+-----------------------------------------------=
---------------+----------<o:p></o:p>

-------------------------------------------+--------+-=
-------+----------+<o:p></o:p>

| sid |
hostname           &nbsp=
;        & nbsp;   =
        &n bsp;   &=
nbsp;       &nb sp;   &n=
bsp;    
| interface<o:p></o:p>

          =
        &n bsp;   &=
nbsp;       &nb sp;   &n=
bsp;       &nbs p;
| filter | detail | encoding |<o:p></o:p>

+-----+-----------------------------------------------=
---------------+----------<o:p></o:p>

-------------------------------------------+--------+-=
-------+----------+<o:p></o:p>

|   1 |
DATADEV:DevicePacket_{3250B567-F55D-4B8C-AEF4-14298A26FA3B}<o:p></o:p></s=
pan>

 | =
DevicePacket_{3250B567-F55D-4B8C-AEF4-14298A26FA3B}
| NULL   |      1 =
|<o:p></o:p>

  0 |<o:p></o:p>

+-----+-----------------------------------------------=
---------------+----------<o:p></o:p>

-------------------------------------------+--------+-=
-------+----------+<o:p></o:p>

1 row in set (0.00 sec)<o:p></o:p>

<o:p> </o:p>

mysql> GRANT INSERT,SELECT on sensor to =
snort;<o:p></o:p>

Query OK, 0 rows affected (0.00 =
sec)<o:p></o:p>

<o:p> </o:p>

mysql><o:p></o:p>

<o:p> </o:p>

Thank you all<o:p></o:p>

<o:p> </o:p>

<o:p> </o:p>

Cody Smith =
CCNA,
MCP<o:p></o:p>

Network Administrator<o:p></o:p>

<st1:place w:st=3D"on"><st1:City w:st=3D"on">Cypress</st1:C=
ity></st1:place> Software
Systems<o:p></o:p>

Phone: (817)514-6777x111<o:p></o:p>

<a href=3D"mailto:Csmith@go-cypress.com"
title=3D"mailto:Csmith@go-cypress.com">Csmith@go-cypress.com</a></=
font><o:p></o:p>

<o:p> </o:p>

</div>

</body>

</html>

------_=_NextPart_001_01C423DD.8BC32A5D--

-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode