snort logging problem

[wallace1819]

hi,

i'm having a problem getting snort to log to mysql and I can't find where I'm going wrong. here is what I have done...

snort.conf:
var HOME_NET $eth0_ADDRESS
var EXTERNAL_NET $HOME_NET
output database: log, mysql, dbname=snort user=snort host=localhost password=xxxx

running snort with:
-U -o -i eth0 -d -D -c /etc/snort/snort.conf

I'm not a mysql guru by any strech of the immagination, but these are the steps I used to setup the data base:

1) mysql -u root -p

with in mysql>
2) create database snort;
3) connect snort
4) source /usr/lib/snort/bin/create_mysql
5) grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to snort;
6) grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to snort@localhost;
7) set password for 'snort'@'localhost'=password('xxxx');
8) set password for 'snort'@'%'=password('xxxx');
9) flush privileges;
10) exit

but when I do a 'echo "SELECT count(*) FROM event" | mysql snort -u root -p' it shows...

count(*)
0

rather than...

count(*)
1

like the doc at http://acidlab.sourceforge.net/acid_config.html says it should.

and a after a portscan nothing shows up in acid. My guess is that I have setup the snort database in mysql incorectly. Can anyone see where I have gone wrong?

thx,
wallace

[-- Thor --]

Is snort working in general (that is, without database logging)? Could be a misconfiguration issue in snort.conf, maybe. Good luck getting that pig to squeal...

Regards,

Jeff

[r101]

Hi,

Try changing your output to alert instead of log to get portscans recorded, i.e.:

output database: alert, mysql, dbname=snort user=snort host=localhost password=xxxx

[exklusve]

See if this will help you out.

https://forums.gentoo.org/viewtopic.php?t=78718&start=0&postdays=0&postorder=asc&highlight=acid+mysql
_________________
eXklusve

You do know that no one gives a shit about your system spec's right?

[Blahbbs]

Check your /var/log/snort/alert file. If there's anything in there, there should be a corresponding entry in your event table of your snort database.

[jtp755]

this thread is kinda old but.....i dont think that snort is workign correctly. I have had it running for almost a day now and i would think that it would pick up stuff already but i have nothign. Not even an alert file in /var/log/snort. ACID hasnt shown anythign either. It there a way i can "test" to see if SNORT is working?
_________________
www.EternalFireProof.com
Registered Linux User #334610

[jesterspet]