Intrusion Detection: Snort, Base, MySQL, and Apache2 On Ubuntu 7.10

Discussion in 'HOWTO-Related Questions' started by tokke, Jan 29, 2008.

  1. tokke

    tokke New Member

    I'm experiencing problems with the howto: Intrusion Detection: Snort, Base, MySQL, and Apache2 On Ubuntu 7.10 (Gutsy Gibbon) (Updated)
    In the beginning everything runs fine but after a while I saw that snort doesnt write anything to the mysql database anymore.
    In the daemon.log file I see following error message:
    snort[4350]: database: mysql_error: MySQL server has gone away SQL=BEGIN

    Anyone has an idea on how to solve this?

    Thx in advance

  2. topdog

    topdog Active Member

  3. topdog

    topdog Active Member

    Sorry my BAD it is a mysql problem that can be fixed with this
    wait_timeout = 604800
    interactive_timeout = 604800
    in your my.cnf

    The restart mysqld.
  4. tokke

    tokke New Member

    Thx for the quick reply.
    I changed the values. No I have to wait to see if it still works after a few days.
  5. tokke

    tokke New Member

    This didn't solve the problem. I have the same error again.
    Anymore ideas?

    Best regards

  6. topdog

    topdog Active Member

    I think then it is a snort problem, from what i have picked up the snort connection does not interact with mysql in time that is why that fix was to allow for a longer time out on the client sending data to the mysql server.

    Check if you are running the latests snort it could have been fixed in a newer release.

Share This Page