Frequently Asked Questions (FAQ)

---

The most straightforward method to delete all the data (i.e., return to the state of an empty database) out of a database is to execute the following SQL statements:

  DELETE FROM sensor;
  DELETE FROM event;
  DELETE FROM iphdr;
  DELETE FROM tcphdr;
  DELETE FROM udphdr;
  DELETE FROM icmphdr;
  DELETE FROM data;
  DELETE FROM opt;
  DELETE FROM signature;
  DELETE FROM sig_class;
  DELETE FROM sig_reference;
  DELETE FROM reference;
  DELETE FROM reference_system;

Remember, this is not a selective delete process. All alerts in the database will be irrecoverably purged.

Errors

(C-1) Common compilation errors

libmysqlclient.a(my_compress.o): In function `my_uncompress':
   my_compress.o(.text+0x9a): undefined reference to `uncompress'
libmysqlclient.a(my_compress.o): In function `my_compress_alloc':
   my_compress.o(.text+0x12a): undefined reference to `compress'

The linker is unable to resolve certain compression routines needed by the MySQL client library. Add "-lz" to the "LIBS" variable in the Makefile

---

(C-2) Common startup errors

database: compiled support for ( )
database: configured to use mysql
database: mysql support is not compiled in this copy

Check your configuration file to be sure you did not mis-spell "mysql".
If you did not, you will need to reconfigure and recompile ensuring that
you have set the correct options to the configure script. Type
"./configure --help" to see options for the configure script.

Fatal Error, Quitting..

Support for each database needs to be explicitly compiled into snort. This error indicates that the build of snort currently being used does not support the desired database (e.g., mysql, postgresql, oracle, mssql, odbc).

If this instance of snort was built from source, see Step #2: Install Snort of the database plugin Installation documentation

If this instance of snort was a rebuilt binary, go back to the distributer and look for a pre-built binary of snort with database support. Such builds are often named "snort+mysql" or "snort-mysql".

---

WARNING: command line overrides rules file alert plugin!

In snort, the command line arguments will always override the configuration directives set in the configuration file. Using the "-A" or "-s" arguments will override and disable any database logging configuration. If multiple output targets are desired (e.g. logging to a file and the database), use the configuration file to setup these plugins.

---

database: The underlying database seems to be running an older version of the DB schema.

In order to support the richer features found in snort with every new release, the database schema used to log events must change. When an upgrade of snort is deployed, it is often the case that the database used to store alerts from the previous version is no longer compatible. In certain cases, the older database can be undated, but when large changes occur re-creating a new database is the only easy option. The schema to use with a given version of snort can always be found in the "contrib" directory in the snort distribution. See the database schema documentation for more information.

---

database: Problem obtaining SENSOR ID (sid) from ...

Prior to logging any alerts, the database plugin will lookup (and if necessary write) information about this instance of snort into the database. This error indicates that snort was able to successfully connect to the alert database, but was unable to read or write to the one of the tables (i.e., sensor). Most likely insufficient privileges have been given to the snort database user. See the Step #6: Grant permission to the database user of the installation instructions.

(C-3) Common MySQL errors

database: mysql_error: Can't connect to local MySQL server through socket 'some_path/mysql.sock' (2)

MySQL has been configured to communicate over a UNIX domain socket, but this socket file could not be found in the default directory.

• Verify that the MySQL server has been started.

• Verify that the mysql.sock file exists in the directory listed in the error and confirm that the appropriate permission have been set (the user running the MySQL daemon needs to have at least read access).

  The socket file is often found in /tmp or /var/lib/mysql.

• If the socket file does not exist in the directory indicated in the error message, the location must be explicitly specified. Use the --socket switch of the MySQL server (mysqld --socket=path_to_socket) to set the correct socket directory or set the path in the MySQL configuration file my.cnf as follows:

         [client]
         socket=path-for-socket-file
  
         [mysqld]
         socket=path-for-socket-file
       

---

FATAL ERROR: database: mysql_error: Access denied for user: 'acid@localhost' (Using password: YES)

The database user and the provided credentials cannot authenticate to the MySQL alert database.

• Verify that the password specified is correct. If you use special characters in the password, such as '$' (a dollar sign), try removing them.

• MySQL assigns privileges on a per-user-per-host basis. Verify that the particular host (i.e. the web server) and user combination have the appropriate privileges.

• Some resolvers have difficulty with 'localhost' as a hostname. Try specifying "127.0.0.1" as the hostname.

For additional information on "Accessed denied" error messages consult the MySQL documentation: http://www.mysql.com/doc/A/c/Access_denied.html

---

snort: error loading shared libraries: libmysqlclient.so ... : No such file or directory

The run-time linker is unable to find the MySQL library. Locate the directory in which this shared library is stored then either update the environment variable LD_LIBRARY_PATH with this path or (if in Linux) add this directory to /etc/ld.so.conf (and run ldconfig).