Intrusion Detection: Snort, Base, MySQL, and Apache2 On Ubuntu 7.10

[tokke]

I'm experiencing problems with the howto: Intrusion Detection: Snort, Base, MySQL, and Apache2 On Ubuntu 7.10 (Gutsy Gibbon) (Updated)
In the beginning everything runs fine but after a while I saw that snort doesnt write anything to the mysql database anymore.
In the daemon.log file I see following error message:
snort[4350]: database: mysql_error: MySQL server has gone away SQL=BEGIN

Anyone has an idea on how to solve this?

Thx in advance

Tokke

[topdog]

This seems to be a bug in snort not a mysql problem.

http://www.snort.org/archive-1-3159.html

[topdog]

Sorry my BAD it is a mysql problem that can be fixed with this

[mysqld]
#
wait_timeout = 604800
interactive_timeout = 604800


in your my.cnf

The restart mysqld.

[tokke]

Thx for the quick reply.
I changed the values. No I have to wait to see if it still works after a few days.

[tokke]

Sorry my BAD it is a mysql problem that can be fixed with this

[mysqld]
#
wait_timeout = 604800
interactive_timeout = 604800


in your my.cnf

The restart mysqld.

This didn't solve the problem. I have the same error again.
Anymore ideas?

Best regards

Tokke

[topdog]

I think then it is a snort problem, from what i have picked up the snort connection does not interact with mysql in time that is why that fix was to allow for a longer time out on the client sending data to the mysql server.

Check if you are running the latests snort it could have been fixed in a newer release.