logo       

Choosing A Webhost:
A web hosting service is a type of Internet hosting service that allows individuals and organizations to provide their own website accessible via the World Wide Web. Web hosts are companies that provide space on a server they own for use by their clients as well as providing Internet connectivity, typically in a data center. Web hosts can also provide data center space and connectivity to the Internet for servers they do not own to be located in their data center, called colocation. more...

Wood's barnyard-mssql patch: msg#00013

security.ids.snort.barnyard.user

Subject: Wood's barnyard-mssql patch

I'm having trouble with David's (1) mssql patch. I applied it to barnyard-0.2.0 and created mssql tables and an sql account with insert/read privileges.

(1) http://sourceforge.net/mailarchive/forum.php? thread_id=5948053&forum_id=7997

barnyard.conf looks as follows:
output log_acid_db: tds, sensor_id 1, database Logs, server ntserver3, user sensor, password xxxxxx, detail full

sqlsh tell us that the table at least exists.... even if it is empty:

latex:/var/log/snort# sqsh -I /etc/freetds/freetds.conf -U logger -P "zqvjwkm" -S ntserver3 -D Logs
sqsh-2.1 Copyright (C) 1995-2001 Scott C. Gray
This is free software with ABSOLUTELY NO WARRANTY
For more information type '\warranty'
1> select * from event;
2> go
(0 rows affected)

Finally barnyard+mssqpatch is run with verbose logging on a one time run through of a unified log:
It looks like we connect and change database contexts fine, but it dies as it tries to reference the event table.

latex:/var/log/snort# /usr/local/bin/barnyard -o snort.unified.log.1101245338 -vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
Barnyard Version 0.2.0 (Build 32)
... SNIPED all but program variables......
Program Variables:
Batch processing mode
Config dir: /etc/snort
Config file: /etc/snort/barnyard.conf
Sid-msg file: /etc/snort/sid-msg.map
Gen-msg file: /etc/snort/gen-msg.map
Class file: /etc/snort/classification.config
Hostname: latex.internal.compu-share.com
Interface:
BPF Filter:
Log dir: /var/log/snort
Verbosity: 39
Localtime: 0
File list:
/var/log/snort/snort.unified.log.1101245338
Processing: /var/log/snort/snort.unified.log.1101245338
OpAcidDB configured
Database Flavour: tds
Detail Level: Full
Database Server: ntserver3
Database User: sensor
Msg 5701, Level 0, State 2
Server 'NTSERVER3',
Changed database context to 'Logs'.
Msg 5703, Level 0, State 1
Server 'NTSERVER3',
Changed language setting to us_english.
Msg 5701, Level 0, State 1
Server 'NTSERVER3', Line 1
Changed database context to 'Logs'.
Msg 208, Level 16, State 1
Server 'NTSERVER3', Line 1
Invalid object name 'event'.
Msg 5, Level -1, State 20018
Segmentation fault
latex:/var/log/snort#



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/


<Prev in Thread] Current Thread [Next in Thread>
Google Custom Search

Recently Viewed:
qnx.openqnx.dev...    gcc.libstdc++.c...    solaris.opensol...    information-ret...    misc.misterhous...    web.catalyst.ge...    apache.webservi...    redhat.release....    hardware.lirc/2...    kernel.autofs/2...    technology.sust...    linux.vdr/2003-...    editors.lyx.gen...    org.user-groups...    netbsd.devel.pk...    xdg.devel/2004-...    version-control...    jakarta.slide.d...    debian.packages...    creativecommons...    ports.ppc.embed...    bug-tracking.bu...   
Home | blog view | USPTO Patent Archive | advertise | OSDir is an inevitable website. super tiny logo

Free Magazines

Cisco News
Receive a free quarterly e-newsletter with exclusive articles on how Cisco IT uses its own products and solutions to enable the business.
subscribe

Systems Management News, the newspaper for IT systems administration and data center managers! Each issue of Systems Management News is chock-full of news and analysis to help you understand what's happening in your field.
subscribe

The Enterprise Newsweekly eWeek is the essential technology information source for builders of e-business.
subscribe

Oracle Magazine Oracle Magazine contains technology strategy articles, sample code, tips, Oracle and partner news, how to articles for developers and DBAs, and more. Oracle (NASDAQ: ORCL) is the world's largest enterprise software company.
subscribe

Total Telecom Total Telecom is "The Economist of the communications industry".
subscribe

Navigation