Re: FW: Little help with SnortSnarf

Ed Davison <[email protected]> Wed, 18 Feb 2004 16:47:35 -0600
Newsgroups gmane.comp.security.ids.snort.snarf
Organization McCombs School of Business
Message-ID <[email protected]>
Sorry for the delay in my answer back to you on this.

Did you try "perl -c SnortDBInput.pm" ?  Normally, that is the one that
ends up with errors if there are any.

Please let me know back on this so I can help sort this out.

Ed


On Wed, 2004-02-04 at 20:58, Lance Lloyd wrote:
> I recently built a new mysql/acid/snortsnarf box to replace the
> antiquated machine I was running.  I believe that I have mirrored the
> install but can't for the life of me get Snarf working.  Here's the
> error I'm getting when running and how I'm running it:
>  
> perl snortsnarf.pl -d /var/www/html/snortsnarf/$dir
> snort:snort@snort2@localhost:3307 -onewindow
>  
> Error connecting to localhost as snort; skipping    
>  
> My first thought was that it was a permissions thing so i verified my
> grants for the user snort and tested the connection using "mysql
> snort2 -u snort -p" and it connects fine and I can query everything. 
> I've even tried running this as root, with the same outcome.
>  
> I looked online and noticed that you had instructed people to double
> check their perl modules with the perl -c command, so I verified
> DBI.pm, mysql.pm, and SnortDBI.pm and they all came back fine.
>  
> I've gone full circle on this thing, even deleting then reinstalling. 
> If you can give me some insight into other tests that I can do to try
> to narrow this down I'd appreciate it.  The error message isn't too
> descriptive.
>  
> Thanks in advance for the help.
>  
> Lance