FW: Little help with SnortSnarf
"Lance Lloyd" <[email protected]> Wed, 4 Feb 2004 18:58:12 -0800
| Newsgroups | gmane.comp.security.ids.snort.snarf |
|---|---|
| Message-ID | <D8E7F287280F1546A141E9F8593275CD0122802C@seaexch04.corp.avenuea.com> |
This is a multi-part message in MIME format. ------_=_NextPart_001_01C3EB93.E4CD8F24 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I recently built a new mysql/acid/snortsnarf box to replace the antiquated machine I was running. I believe that I have mirrored the install but can't for the life of me get Snarf working. Here's the error I'm getting when running and how I'm running it: =20 perl snortsnarf.pl -d /var/www/html/snortsnarf/$dir snort:snort@snort2@localhost:3307 -onewindow =20 Error connecting to localhost as snort; skipping =20 =20 My first thought was that it was a permissions thing so i verified my grants for the user snort and tested the connection using "mysql snort2 -u snort -p" and it connects fine and I can query everything. I've even tried running this as root, with the same outcome. =20 I looked online and noticed that you had instructed people to double check their perl modules with the perl -c command, so I verified DBI.pm, mysql.pm, and SnortDBI.pm and they all came back fine. =20 I've gone full circle on this thing, even deleting then reinstalling. If you can give me some insight into other tests that I can do to try to narrow this down I'd appreciate it. The error message isn't too descriptive. =20 Thanks in advance for the help. =20 Lance ------_=_NextPart_001_01C3EB93.E4CD8F24 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD><TITLE>Message</TITLE> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Dus-ascii"> <META content=3D"MSHTML 6.00.2800.1400" name=3DGENERATOR></HEAD> <BODY> <DIV><FONT face=3DArial size=3D2><SPAN class=3D402021718-30012004>I = recently built a=20 new mysql/acid/snortsnarf box to replace the antiquated machine I was=20 running. I believe that I have mirrored the install but can't for = the life=20 of me get Snarf working. Here's the error I'm getting when running = and how=20 I'm running it:</SPAN></FONT></DIV> <DIV><FONT size=3D2></FONT> </DIV> <DIV><FONT face=3DArial size=3D2>perl snortsnarf.pl -d=20 /var/www/html/snortsnarf/<SPAN class=3D402021718-30012004>$dir=20 </SPAN>snort:snort@snort2@localhost:3307 -onewindow</FONT></DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV><FONT size=3D2><FONT face=3DArial>Error connecting to localhost as = snort;=20 skipping<SPAN class=3D402021718-30012004> =20 </SPAN></FONT></FONT></DIV> <DIV><FONT face=3DArial size=3D2><SPAN=20 class=3D402021718-30012004></SPAN></FONT> </DIV> <DIV><FONT face=3DArial size=3D2><SPAN class=3D402021718-30012004>My = first thought was=20 that it was a permissions thing so i verified my grants for the user = snort and=20 tested the connection using "mysql snort2 -u snort -p" and it connects = fine and=20 I can query everything. I've even tried running this as root, with = the=20 same outcome.</SPAN></FONT></DIV> <DIV><FONT face=3DArial size=3D2><SPAN=20 class=3D402021718-30012004></SPAN></FONT> </DIV> <DIV><FONT face=3DArial size=3D2><SPAN class=3D402021718-30012004>I = looked online and=20 noticed that you had instructed people to double check their perl = modules with=20 the perl -c command, so I verified DBI.pm, mysql.pm, and SnortDBI.pm and = they=20 all came back fine.</SPAN></FONT></DIV> <DIV><FONT face=3DArial size=3D2><SPAN=20 class=3D402021718-30012004></SPAN></FONT> </DIV> <DIV><FONT face=3DArial size=3D2><SPAN class=3D402021718-30012004>I've = gone full=20 circle on this thing, even deleting then reinstalling. If you can = give me=20 some insight into other tests that I can do to try to narrow this down = I'd=20 appreciate it. The error message isn't too=20 descriptive.</SPAN></FONT></DIV> <DIV><FONT face=3DArial size=3D2><SPAN=20 class=3D402021718-30012004></SPAN></FONT> </DIV> <DIV><FONT face=3DArial size=3D2><SPAN class=3D402021718-30012004>Thanks = in advance=20 for the help.</SPAN></FONT></DIV> <DIV><FONT face=3DArial size=3D2><SPAN=20 class=3D402021718-30012004></SPAN></FONT> </DIV> <DIV><FONT face=3DArial size=3D2><SPAN=20 class=3D402021718-30012004>Lance</SPAN></FONT></DIV></BODY></HTML> =00 ------_=_NextPart_001_01C3EB93.E4CD8F24--