Intrusion Detection: Snort, Base, MySQL, and Apache2 On Ubuntu 7.10

Discussion in 'HOWTO-Related Questions' started by tokke, Jan 29, 2008.

  1. tokke

    tokke New Member

    I'm experiencing problems with the howto: Intrusion Detection: Snort, Base, MySQL, and Apache2 On Ubuntu 7.10 (Gutsy Gibbon) (Updated)
    In the beginning everything runs fine but after a while I saw that snort doesnt write anything to the mysql database anymore.
    In the daemon.log file I see following error message:
    snort[4350]: database: mysql_error: MySQL server has gone away SQL=BEGIN

    Anyone has an idea on how to solve this?

    Thx in advance

    Tokke
     
  2. topdog

    topdog Active Member HowtoForge Supporter

  3. topdog

    topdog Active Member HowtoForge Supporter

    Sorry my BAD it is a mysql problem that can be fixed with this
    Code:
    [mysqld]
    #
    wait_timeout = 604800
    interactive_timeout = 604800
    
    in your my.cnf

    The restart mysqld.
     
  4. tokke

    tokke New Member

    Thx for the quick reply.
    I changed the values. No I have to wait to see if it still works after a few days.
     
  5. tokke

    tokke New Member

    This didn't solve the problem. I have the same error again.
    Anymore ideas?

    Best regards

    Tokke
     
  6. topdog

    topdog Active Member HowtoForge Supporter

    I think then it is a snort problem, from what i have picked up the snort connection does not interact with mysql in time that is why that fix was to allow for a longer time out on the client sending data to the mysql server.

    Check if you are running the latests snort it could have been fixed in a newer release.
     

Share This Page