RE: [Snort-users] Snort 2.2.0 & ACID 0.9.6b23

Pedro,

I've tried the alert, and I get even less information being passed to
acid.

With the log feature, acid will indicate that there are new alerts, but
won't display them. With the alert option, it still will not display
any specific alerts, but it will also not tell me that there are new
alerts.

Any additional suggestions would be welcome.

Thanks,

Matthew Lee

-----Original Message-----
From: Pedro Fortuna [mailto:pedro.fortuna@gmail.com]=20
Sent: Friday, September 10, 2004 2:04 PM
To: Matthew K. Lee
Cc: snort-users@lists.sourceforge.net
Subject: Re: [Snort-users] Snort 2.2.0 & ACID 0.9.6b23

try:
output database: alert, mysql, user=3D<username> password=3D<password>
dbname=3Dsnort host=3Dlocalhost

Best Regards,
Pedro Fortuna

On Fri, 10 Sep 2004 13:57:11 -0500, Matthew K. Lee <mattl@rycan.com>
wrote:
> Pedro,
>=20
> output database: log, mysql, user=3D<username> password=3D<password>
> dbname=3Dsnort host=3Dlocalhost
>=20
> (With the correct values for username and password, of course.)
>=20
> The interesting this is that I'm actually getting information in the
> snort.event, snort.data, snort.icmphdr, snort.tcphdr, etc. I am not
> getting any records created in the acid tables, however.
>=20
> I've tried dropping and recreating all the tables. I've tried
dropping
> and recreating the database. All with no luck.
>=20
> Thanks,
>=20
> Matthew Lee
>=20
>=20
>=20
> -----Original Message-----
> From: Pedro Fortuna [mailto:pedro.fortuna@gmail.com]
> Sent: Friday, September 10, 2004 1:43 PM
> To: Matthew K. Lee
> Cc: snort-users@lists.sourceforge.net
> Subject: Re: [Snort-users] Snort 2.2.0 & ACID 0.9.6b23
>=20
> How's your "output database: " line in snort.conf ?
> Pedro Fortuna
>=20
> On Fri, 10 Sep 2004 10:01:28 -0500, Matthew K. Lee <mattl@rycan.com>
> wrote:
> > Hello all,
> >
> > I'm running snort-2.2.0, mysql (with schema 106), and acid 0.9.6b23.
> > I'm getting some of the alert information to show up in acid, but
the
> > actual alerts are not displayed. I've checked the database, and the
> > information is being logged correctly. It seems as though the alert
> > page is just not returning any rows. I wonder if there was a change
> in
> > the schema version that may have broken compatibility with ACID
> > 0.9.6b23?
> >
> > Has anyone else encountered this? If so, what did you do to resolve
> the
> > issue?
> >
> > Thanks,
> >
> > Matthew Lee
> >
> > -------------------------------------------------------
> > This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
> > Project Admins to receive an Apple iPod Mini FREE for your judgement
> on
> > who ports your project to Linux PPC the best. Sponsored by IBM.
> > Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users@lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/...fo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?listsnort-users
> >
>


-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users