Re: Snort

[David Hardne <dh@cybe.net>]

 Phillip Hofmeister wrote on Feb 17, 2003 at 10:19:24 AM:
> All,
> 
> I have been having problems with snort, this may be kind of OT for this
> list (should be debian-user) but I have a feeling more people on this
> list use snort.
> 
> I manage 2 potato converted to woody machines.  Each morning I receive 2
> blank reports from cron.daily.
> 
> I have snort-mysql installed.  snort appears to be running fine but
> nothing ever gets written to the mysql database.  The username/password
> I gave snort have update/select/insert rights to the mysql DB.
> 
> Any clue of where I can start looking for problems as to why this isn't
> working?
> 
> Thanks,
> 
> -- 
> Phil
> 

I don't know about snort-mysql, but I got the same empty reports
initially from snort (non-mysql package) on a woody machine also
upgraded from potato. 

In my case the problem was snort by default logging only to 
/var/log/alerts, while snort-stat (running from /etc/cron.daily/5snort) 
was operating on /var/log/auth.log.  

Regards,

David

-- 
 .- David Hardne <dh@cybe.net>
 `-- wget -O- cybe.net/dh|gpg --import