Snort mailing list archives

WinXP-1.9-MySQL-2 sensors, 1 collector and the 1067 error


From: "Ty Brewer" <tbrewer () pplinc com>
Date: Tue, 18 Feb 2003 16:40:51 -0600

I have installed Snort 1.9 on 2 WinXP machines using MySQL 4.0.10 gamma.
Everything seems to work fine on each machine when running in a
standalone configuration. Both machines are configured to have Snort run
as a service and save to a local MySQL database. When logging alerts and
logs locally, each machine works perfectly.
 
I would like to configure one machine to be a sensor and the other to be
used exclusively for MySQL and ACID (collector).
 
Unfortunately, when I configure the 2nd machine (sensor) to point to the
1st machine (collector), I get the dreaded 1067 error when I start the
service on the sensor.
I have tried this with Snort both running and not running on the
collector.
 
here is a portion of the snort.conf file from the sensor:
output database: log, mysql, user=snort2@sensor password=123
dbname=snort host=32.77.73.150 port=3306 sensor_name=sensor
output database: alert, mysql, user=snort2@sensor password=123
dbname=snort host=32.77.73.150 port=3306 sensor_name=sensor
 
I've also tried these variations (the cat in the cage method):
user=root
user=snort
user=snort2
user=snort2@sensor
 
host=collector (the MySQL collector)
sensor_name=collector
 
It acts like this might be a MySQL problem, but I have created the
snort2 user on the collector's MySQL instance. Perhaps I have created
the user incorrectly?
 
Once I get this working, I'll add yet another sensor to point to the
collector (2 sensors, 1 collector).
 
Any help is appreciated,
Ty

Current thread: