Re: More problems with snortsnarf

On Thu, 2003-02-13 at 22:28, James Hoagland wrote:
> At 1:43 PM -0600 2/13/03, Paul Schmehl wrote:
> >I used the same commandline that I posted here earlier with one change.
> >I used -maxtime=now.  This *should* run very quickly, right?
> 
> -maxtime=now should have almost no effect.  However, you might have 
> meant -mintime=now.

No, I meant maxtime, because I was trying to get snortsnarf to run on
the least amount of data possible, just to see if I could get any output
at all.  Unless I've completely misunderstood the documentation. 
Maxtime is not supposed to show any alerts older than the time value, so
if I use "now", that should limit the alerts shown to a handful and make
snortsnarf run and complete much more quickly, right?

> 
> I've made sure the maintainers of SnortDBInput.pm are aware of this.
> 
Thanks, Jim.  I've been in touch with Ed, and he sent me a newer version
of the pm.  We've also been corresponding about the problems that I'm
having, and one thing Ed pointed out was that I wasn't specifying the
port for mysql.  After I did that, snortsnarf created the default pages
(index.html, etc.) which it had never done before, but it still failed
to complete a run and present any data.

I'm still getting a bunch of "Use of uninitialized value" errors from
the perl module, and I still have no useful output.

-- 
Paul Schmehl ([email protected])
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/~pauls/
AVIEN Founding Member