Re: Snort - Fatal Error

["prabu" <prabu333 () hotpop com>]

Hello Shankar,
      First tell about your database configuration.I guess that u might have
not commented the (/etc/snort/snort.conf:453 line,since it is used for
enabling log alerts to syslog.U should comment this line,if u want to enable
the databes loggging,since that line of the config file specifies to alert
the output of logs to syslog.

if u r using databes logging ,then ur snort.conf should have line as,
for example,output database: log, mysql, dbname=snort user=root
host=localhost password=kovai
For better understanding,go to directory /src/doc,See the README.database
file for more information about configuring and using this plugin.

-Prabu.S





----- Original Message ----- 

From: "Shankar" <list () zeeaccess com>
To: "Snort-Users" <snort-users () lists sourceforge net>
Sent: Monday, July 26, 2004 3:52 PM
Subject: [Snort-users] Snort - Fatal Error


> Hi Snort Users,
>
> I am new to snort, read the snort manual by Patrick Harper (manual ver
7.2)
> and implemented the same , as it is.
> I get an error, ERROR: Undefined variable name:
(/etc/snort/snort.conf:453):
> Fatal Error, Quitting..
> Line-453 output database: log, mysql, user=snort password=mypassword
> dbname=snort host=localhost
>
> [root@snort]# snort -c /etc/snort/snort.conf
> Running in IDS mode
> Log directory = /var/log/snort
>
> Initializing Network Interface eth0
>
>         --== Initializing Snort ==--
> Initializing Output Plugins!
> Decoding Ethernet on interface eth0
> Initializing Preprocessors!
> Initializing Plug-ins!
> Parsing Rules file /etc/snort/snort.conf
>
> +++++++++++++++++++++++++++++++++++++++++++++++++++
> Initializing rule chains...
> ,-----------[Flow Config]----------------------
> | Stats Interval:  0
> | Hash Method:     2
> | Memcap:          10485760
> | Rows  :          4099
> | Overhead Bytes:  16400(%0.16)
> `----------------------------------------------
> No arguments to frag2 directive, setting defaults to:
>     Fragment timeout: 60 seconds
>     Fragment memory cap: 4194304 bytes
>     Fragment min_ttl:   0
>     Fragment ttl_limit: 5
>     Fragment Problems: 0
>     Self preservation threshold: 500
>     Self preservation period: 90
>     Suspend threshold: 1000
>     Suspend period: 30
> Stream4 config:
>     Stateful inspection: ACTIVE
>     Session statistics: INACTIVE
>     Session timeout: 30 seconds
>     Session memory cap: 8388608 bytes
>     State alerts: INACTIVE
>     Evasion alerts: INACTIVE
>     Scan alerts: INACTIVE
>     Log Flushed Streams: INACTIVE
>     MinTTL: 1
>     TTL Limit: 5
>     Async Link: 0
>     State Protection: 0
>     Self preservation threshold: 50
>     Self preservation period: 90
>     Suspend threshold: 200
>     Suspend period: 30
> Stream4_reassemble config:
>     Server reassembly: INACTIVE
>     Client reassembly: ACTIVE
>     Reassembler alerts: ACTIVE
>     Zero out flushed packets: INACTIVE
>     flush_data_diff_size: 500
>     Ports: 21 23 25 53 80 110 111 143 513 1433
>     Emergency Ports: 21 23 25 53 80 110 111 143 513 1433
> HttpInspect Config:
>     GLOBAL CONFIG
>       Max Pipeline Requests:    0
>       Inspection Type:          STATELESS
>       Detect Proxy Usage:       NO
>       IIS Unicode Map Filename: /etc/snort/unicode.map
>       IIS Unicode Map Codepage: 1252
>     DEFAULT SERVER CONFIG:
>       Ports: 80 8080 8180
>       Flow Depth: 300
>       Max Chunk Length: 500000
>       Inspect Pipeline Requests: YES
>       URI Discovery Strict Mode: NO
>       Allow Proxy Usage: NO
>       Disable Alerting: NO
>       Oversize Dir Length: 500
>       Only inspect URI: NO
>       Ascii: YES alert: NO
>       Double Decoding: YES alert: YES
>       %U Encoding: YES alert: YES
>       Bare Byte: YES alert: YES
>       Base36: OFF
>       UTF 8: OFF
>       IIS Unicode: YES alert: YES
>       Multiple Slash: YES alert: NO
>       IIS Backslash: YES alert: NO
>       Directory: YES alert: NO
>       Apache WhiteSpace: YES alert: YES
>       IIS Delimiter: YES alert: YES
>       IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
>       Non-RFC Compliant Characters: NONE
> rpc_decode arguments:
>     Ports to decode RPC on: 111 32771
>     alert_fragments: INACTIVE
>     alert_large_fragments: ACTIVE
>     alert_incomplete: ACTIVE
>     alert_multiple_requests: ACTIVE
> telnet_decode arguments:
>     Ports to decode telnet on: 21 23 25 119
> [root@snort]#
> OS is Fedora Core-1 with all updates from freshrpms
> snort-2.1.3-0
> snort-mysql-2.1.3-0
> adodb411
> acid-0.9.6b23
> zlib-1.2.1
> jpgraph-1.14
> libpcap-0.8.3
> pcre-4.4
> where did i go wrong, pls help, thx in advance.
>
> Regards,
> Shankar.
>
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by BEA Weblogic Workshop
> FREE Java Enterprise J2EE developer tools!
> Get your free copy of BEA WebLogic Workshop 8.1 today.
> http://ads.osdn.com/?ad_id=4721&alloc_id=10040&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.726 / Virus Database: 481 - Release Date: 7/22/2004




-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=4721&alloc_id=10040&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users