Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am following this tutorial: https://help.ubuntu.com/community/SnortIDS

I've set up the database, everything has installed correctly, and I've configured the snort.conf file so it outputs to a database (with creds all filled out ok).

When I run /etc/init.d/snort start, it fails but does not produce any error message other than [fail].

The last few lines of /var/log/syslog are:

snort[5687]: database: must enter database name in configuration file#012
snort[5687]: FATAL ERROR:

My output database line in the snort.conf file is:

output database: log, mysql, user=snort password=... dbname=snort host=localhost

I have tried it with the commas separating everything, putting quotes around stuff, etc. The password is only made up of letters (after I thought maybe a number was throwing it off).

share|improve this question
add comment

1 Answer

[parameter list]

The parameter list consists of key value pairs (See Table 4). The syntax of the parameter list is a series of key=value pairs each separated by a space.

The only parameter that is absolutely necessary is dbname. All other parameters are optional but may be necessary depending on the RDBMS configuration.

Move dbname to be the first parameter to see what happens:

output database: log, mysql, dbname=snort user=snort host=localhost password=...
share|improve this answer
    
Nope, rearranging the line results in the same error. –  Rsaesha Sep 6 '12 at 17:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.