Re: [Snort-users] Acid shows sensors as 0

The line that configures snort to connect in snort.conf is uncommented
and is like this:

output database: log, mysql, user=snort password=******
dbname=snort host=localhost

(****** is the password) and snort connects as snort user in Mysql
and db name in mysql is snort.

I have an empty event table.

mysql> select * from event;
Empty set (0.00 sec)

My question is: when you setup snort and acid, is it supposed to work
normally or do you have to configure other stuff and rules. My guess
is that it should work, even though it might need to be tuned. But
that's another story.

Thank you



On Tue, 23 Nov 2004 15:10:26 -0500, Kevin Johnson
<kjohnson@secureideas.net> wrote:
> On Tue, 2004-11-23 at 14:50, Gentian Hila wrote:
> > Does it mean that is connecting ok ? I guess so ?
> > What table is that snort saves the data ?
> >
> > Thank you very much :)
>
> Hi-
>
> Yes that would mean that Snort is connecting, now we need to figure out
> whether it is actually alerting to the database.
>
> What is the line that you have set up in snort.conf to alert?
>
> i.e.
>
> output database: log, mysql, user=username password=passwd
> dbname=snort_log host=localhost
> Is this uncommented? Also how many rows are in your event table?
>
> Kevin
>
>
> -------------------
> BASE Project Lead
> http://sourceforge.net/projects/secureideas
> http://base.secureideas.net
> The next step in IDS analysis!
>
>
>


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users