Snort mailing list archives
" Problem obtaining SENSOR ID", unable to start snort/access postgres
From: Eli Stair <eli.stair () mchsi com>
Date: Mon, 14 Oct 2002 13:36:15 -0400
I'm having an issue getting snort to start logging to a postgresql 7.2 database.
Being only my second snort install, the first being a simple (and problem-free)
MySQL install I'm a little stumped. I've tracked the archives, and can't find
any resolution for this, as it seems only one other person had this issue.
I'd like to have some input from the community to rule out any stupid mistakes
on my part before I bother reporting it to Jed.
After setting up the database, creating all structures, setting permissions on
the snort user, verifying connectivity, password etc... when running snort it
cannot seem to set the sensor value. Output from snort follows. Any recom-
mendations on where to go with this? Thanks all for your time and knowledge.
Cheers,
/eli
Linux 2.4.19, Mandrake 9.1, Snort 1.8.7 w/ postgresql+flexresp, postgres 7.2
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~``
[root@tardis snort]# snort-postgresql+flexresp -u snort -g snort -d -c /etc/snort/snort.conf
Log directory = /var/log/snort
Initializing Network Interface eth0
--== Initializing Snort ==--
Decoding Ethernet on interface eth0
Initializing Preprocessors!
Initializing Plug-ins!
Initializating Output Plugins!
Parsing Rules file /etc/snort/snort.conf
+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
No arguments to frag2 directive, setting defaults to:
Fragment timeout: 60 seconds
Fragment memory cap: 4194304 bytes
Fragment min_ttl: 0
Fragment ttl_limit: 5
Fragment Problems: 0
Stream4 config:
Stateful inspection: ACTIVE
Session statistics: INACTIVE
Session timeout: 30 seconds
Session memory cap: 8388608 bytes
State alerts: INACTIVE
Evasion alerts: INACTIVE
Scan alerts: ACTIVE
Log Flushed Streams: INACTIVE
MinTTL: 1
TTL Limit: 5
No arguments to stream4_reassemble, setting defaults:
Reassemble client: ACTIVE
Reassemble server: INACTIVE
Reassemble ports: 21 23 25 53 80 143 110 111 513
Reassembly alerts: ACTIVE
Reassembly method: FAVOR_OLD
database: compiled support for ( postgresql )
database: configured to use postgresql
database: user = snort
database: password is set
database: database name = snort
database: host = localhost
database: sensor name = 12.219.134.40
database: postgresql_error: ERROR: sensor_sid_seq.nextval: you don't have permissions to set sequence sensor_sid_seq
database: Problem obtaining SENSOR ID (sid) from postgresql->snort->sensor
When this plugin starts, a SELECT query is run to find the sensor id for the
currently running sensor. If the sensor id is not found, the plugin will run
an INSERT query to insert the proper data and generate a new sensor id. Then a
SELECT query is run to get the newly allocated sensor id. If that fails then
this error message is generated.
Some possible causes for this error are:
* the user does not have proper INSERT or SELECT privileges
* the sensor table does not exist
If you are _absolutly_ certain that you have the proper privileges set and
that your database structure is built properly please let me know if you
continue to get this error. You can contact me at (jed () pickel net).
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- " Problem obtaining SENSOR ID", unable to start snort/access postgres Eli Stair (Oct 14)
- Message not available
- Re: " Problem obtaining SENSOR ID", unable to start snort/access postgres Eli Stair (Oct 14)
- Message not available
- Message not available
- Re: " Problem obtaining SENSOR ID", unable to start snort/access postgres Eli Stair (Oct 14)
