Re: SNORT 2.0.0 :: ODBC :: FREETDS :: SQL SERVER

["Secureplay" <secureplay () sbcglobal net>]

It is horibly broken in 2.0.x, I don't know about older versions. 
I fixed my copy to work in the environment you specified (except that I use
freebsd instead of linux, but I do use freetds & unixodbc) and it appears to
work for me right now.

I had a memory leak which I think I fixed (maybe?) but I'm still seeing one
issue with some inserts that fail because the database fields are too small.
I am putting in code to track down what that insert could be.

If you want to try out my patch, drop me a line. I don't consider it "ready
for primetime" yet. I may have also broken support for other servers in the
process of patching this one.

-v

------=_NextPart_000_01F7_01C38DB3.A3E0FFC0
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Dear Snort Users,

When I start SNORT using the command line "snort -b -o -i eth0 -c =
/home/pacotes/snort.network.conf" i am receiving the following message :

"
database: Problem obtaining SENSOR ID (sid) from snort->sensor
ERROR:=20
 When this plugin starts, a SELECT query is run to find the sensor id =
for the
 currently running sensor. If the sensor id is not found, the plugin =
will run
 an INSERT query to insert the proper data and generate a new sensor id. =
Then a
 SELECT query is run to get the newly allocated sensor id. If that fails =
then
 this error message is generated.

 Some possible causes for this error are:
  * the user does not have proper INSERT or SELECT privileges
  * the sensor table does not exist

 If you are _absolutely_ certain that you have the proper privileges set =
and
 that your database structure is built properly please let me know if =
you
 continue to get this error. You can contact me at (roman () danyliw com).

Fatal Error, Quitting..
"

My Environment :

- Snort-2.0.0 ( UnixODBC / FreeTDS )
- Linux Red Hat 9.0
- SQL Server 2000 ( Windows 2000 Server )


The user have all database permissions. With "SQL Profiler" I checked =
that the INSERT command is not executing in SQL Server, just the two =
SELECT. With ISQL, using the same user of snort, I can execute the =
SELECT and INSERT normally.

Please, I need some help to solve this problem.

Thx,

Rodrigo Lima de Oliveira

Ps.: Sorry my bad english, my real language is portuguese.



-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
SourceForge.net hosts over 70,000 Open Source Projects.
See the people who have HELPED US provide better services:
Click here: http://sourceforge.net/supporters.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users