Re: Snort My SQL DB

["Joel Esler (jesler)" <jesler () cisco com>]

Yes, you need that table.  it’s required by Base.


--
Joel Esler
Manager, Talos Group




> On Jun 23, 2016, at 6:37 AM, Arun Saini <mailarunsaini () gmail com> wrote:
>
> Hi,
>
> we are using Barnyard2 version 2.1.13<build 327> and ​attached ​error sc​r​e​e​n shot ​for information​,
>
>  snort version 2.9.5.5 GRE [build 205]
> libpcap version 1.3.0
> PCRE 8.30 2012-02-04
> Zlib 1.2.7
>
> Mysql snort databese tables,
>
> mysql> show tables;
> +------------------+
> | Tables_in_snort  |
> +------------------+
> | acid_ag          |
> | acid_ag_alert    |
> | acid_event         |
> | acid_ip_cache    |
> | base_roles       |
> | base_users       |
> | data             |
> | detail           |
> | encoding         |
> | event            |
> | icmphdr          |
> | iphdr            |
> | opt              |
> | reference        |
> | reference_system |
> | schema           |
> | sensor           |
> | sig_class        |
> | sig_reference    |
> | signature        |
> | tcphdr           |
> | udphdr           |
> +------------------+
> do we need  acid_event  table in our database it ? or please suggest us whether do we actually require"acid_ag        
>   |
> | acid_ag_alert    |
> | acid_event         |
> | acid_ip_cache "
>
> in our database ?
> it is the table where the screen shot saying that the events are not found the way...
> surely we will upgrade our snort but just want to diagnose why this error is coming on screen.
>
>
> ​​Sincerely,
> Arun Saini
> Mobile :+91-9890738762
>
> On 23 June 2016 at 07:33, Joel Esler (jesler) <jesler () cisco com <mailto:jesler () cisco com>> wrote:
> I would help us tremendously if you could tell us what version of Barnyard2 you are using, what error you are 
> receiving, and even, if you could update your version of Snort, to something that is supported, that'd be great too.
>
> --
> Joel Esler
> Manager, Talos Group
> Sent from my iPad
>
> On Jun 22, 2016, at 9:24 PM, Arun Saini <mailarunsaini () gmail com <mailto:mailarunsaini () gmail com>> wrote:
>
> > Hi,
> > Can anyone help me to know the table names under mysql dB for snort from where Base read the data,actually I have a 
> > table named as acid_events and acid_cache where some of the records/data failed to inset, and on base screen I get 
> > notification I.e.alerts have NOT found their way into acid " please see attached screen , requesting you to please 
> > help us to resolve the issue ..
> >
> > we are using snort version 2.9.5.5 GRE [build 205]
> >
> > libpcap version 1.3.0
> >
> > PCRE 8.30 2012-02-04
> >
> > Zlib 1.2.7
> >
> > I can provide the screen shot if required!!!
> >
> >
> > ​​​​Sincerely,
> >
> > Arun Saini
> > Mobile :+91-9890738762
> >
> >
> > ------------------------------------------------------------------------------
> > Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
> > Francisco, CA to explore cutting-edge tech and listen to tech luminaries
> > present their vision of the future. This family event has something for
> > everyone, including kids. Get more information and register today.
> > http://sdm.link/attshape <http://sdm.link/attshape>_______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net <mailto:Snort-users () lists sourceforge net>
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users <https://lists.sourceforge.net/lists/listinfo/snort-users>
> > Snort-users list archive:
> > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users 
> > <http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users>
> >
> > Please visit http://blog.snort.org <http://blog.snort.org/> to stay current on all the latest Snort news!
>
>
> <not found the way to acid events.png><alerts have NOT found their way into acid.png>

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail

------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!