snort question?

skynet

你的SNORT边接MYSQL时就出错了，你回去检查下MYSQL有无什么问题。
如果还没有什么不明白的，可以去WWW.SNORT.ORG看下。

skynet

你详细写出你怎么安装MYSQL的过程。
正常这样：

groupadd mysql
useradd -g mysql mysql
在你的/root/.bash_profile里增加一行
PATH=$PATHHOME/bin:/usr/local/mysql/bin

安装
tar -zxvf mysql*.tar.gz
cd mysql*
./configure --prefix=/usr/local/mysql
make
make install
scripts/mysql_install_db
chown -R root /usr/local/mysql
chown -R mysql /usr/local/mysql/var
chgrp -R mysql /usr/local/mysql
cp support-file/my-medium.cnf /etc/my.cnf

然后在/etc/ld.so.conf 里增加
/usr/local/mysql/lib/mysql
/usr/local/lib


ldconfig -v

你其实可以去www.snort.org有详细的安装文档和问题解问的。

skynet

Setting up the database in MySQL:
I will put a line with a >; in front of it so you will see what the output should be. (Note: In
MySQL, a semi-colon ” ; “character is mandatory at the end of each input line)
(new_password is whatever password you want to give)
/usr/local/mysql/bin/mysql
mysql>; SET PASSWORD FOR root@localhost=PASSWORD('new_password');
>;Query OK, 0 rows affected (0.25 sec)
mysql>; create database snort;
>;Query OK, 1 row affected (0.01 sec)
mysql>; grant INSERT,SELECT on root.* to snort@localhost;
>;Query OK, 0 rows affected (0.02 sec)
mysql>; SET PASSWORD FOR snort@localhost=PASSWORD('new_password');
>;Query OK, 0 rows affected (0.25 sec)
mysql>; grant CREATE, INSERT, SELECT, DELETE, UPDATE on snort.* to snort@localhost;
>;Query OK, 0 rows affected (0.02 sec)
mysql>; grant CREATE, INSERT, SELECT, DELETE, UPDATE on snort.* to snort;
>;Query OK, 0 rows affected (0.02 sec)
mysql>; exit
>;Bye
From the Snort 2.1.0 source directory (/root/snortinstall/snort-2.1.0) execute the
following command (when working with MySQL, if it asks for a password it is wanting
the one you defined in the SQL statement “SET PASSWORD FOR
root@localhost=PASSWORD('new_password');”)
/usr/local/mysql/bin/mysql -u root -p < ./contrib/create_mysql snort
Version 6.1 Page 16 of 23 Updated 2/14/2004 1:21 AM
Enter password:
Then install the extra DB tables using the following command from the contrib directory
(you will need to cd to contrib)
zcat snortdb-extra.gz |/usr/local/mysql/bin/mysql -p snort
Enter password:
Now you need to check and make sure that the snort DB was created correctly
/usr/local/mysql/bin/mysql -p
>;Enter password:
mysql>; SHOW DATABASES;
(You should see the following)
+------------+
| Database
+------------+
| mysql
| snort
| test
+------------+
3 rows in set (0.00 sec)
mysql>; use snort
>;Database changed
mysql>; SHOW TABLES;
+------------------+
| Tables_in_snort
+------------------+
| data
| detail
| encoding
| event
| flags
| icmphdr
| iphdr
| opt
| protocols
| reference
| reference_system
| schema
| sensor
| services
| sig_class
| sig_reference
| signature
| tcphdr
Version 6.1 Page 17 of 23 Updated 2/14/2004 1:21 AM
| udphdr
+------------------+
19 rows in set (0.00 sec)>;
exit