Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am following this tutorial:

I've set up the database, everything has installed correctly, and I've configured the snort.conf file so it outputs to a database (with creds all filled out ok).

When I run /etc/init.d/snort start, it fails but does not produce any error message other than [fail].

The last few lines of /var/log/syslog are:

snort[5687]: database: must enter database name in configuration file#012
snort[5687]: FATAL ERROR:

My output database line in the snort.conf file is:

output database: log, mysql, user=snort password=... dbname=snort host=localhost

I have tried it with the commas separating everything, putting quotes around stuff, etc. The password is only made up of letters (after I thought maybe a number was throwing it off).

share|improve this question

[parameter list]

The parameter list consists of key value pairs (See Table 4). The syntax of the parameter list is a series of key=value pairs each separated by a space.

The only parameter that is absolutely necessary is dbname. All other parameters are optional but may be necessary depending on the RDBMS configuration.

Move dbname to be the first parameter to see what happens:

output database: log, mysql, dbname=snort user=snort host=localhost password=...
share|improve this answer
Nope, rearranging the line results in the same error. – Rsaesha Sep 6 '12 at 17:56

In your snort.conf comment the line:

include dabases.conf
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.