Snort Forums Archive

Archive Home » Snort Newbies » Snort running but not writing to Log or MySQL

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

Snort running but not writing to Log or MySQL

Posted by campbellMac on January 27, 2006 15:39:08

Hello,

I have snort running with apparently no errors, however I am getting no alerts in MySQL or the log? Im sure it is something very simple?
Please help, here is the output:

snort -c /etc/snort/snort.conf
***
*** interface device lookup found: eth0
***
Running in IDS mode

Initializing Network Interface eth0

--== Initializing Snort ==--
Initializing Output Plugins!
Decoding Ethernet on interface eth0
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file /etc/snort/snort.conf

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
,-----------[Flow Config]----------------------
| Stats Interval: 0
| Hash Method: 2
| Memcap: 10485760
| Rows : 4099
| Overhead Bytes: 16400(%0.16)
`----------------------------------------------
Frag3 global config:
Max frags: 65536
Fragment memory cap: 4194304 bytes
Frag3 engine config:
Target-based policy: FIRST
Fragment timeout: 60 seconds
Fragment min_ttl: 1
Fragment ttl_limit: 5
Fragment Problems: 1
Bound Addresses: 0.0.0.0/0.0.0.0
Stream4 config:
Stateful inspection: ACTIVE
Session statistics: INACTIVE
Session timeout: 30 seconds
Session memory cap: 8388608 bytes
Session count max: 8192 sessions
Session cleanup count: 5
State alerts: INACTIVE
Evasion alerts: INACTIVE
Scan alerts: INACTIVE
Log Flushed Streams: INACTIVE
MinTTL: 1
TTL Limit: 5
Async Link: 0
State Protection: 0
Self preservation threshold: 50
Self preservation period: 90
Suspend threshold: 200
Suspend period: 30
Enforce TCP State: INACTIVE
Midstream Drop Alerts: INACTIVE
Server Data Inspection Limit: -1
WARNING /etc/snort/snort.conf(372) => flush_behavior set in config file, using old static flushpoints (0)
Stream4_reassemble config:
Server reassembly: INACTIVE
Client reassembly: ACTIVE
Reassembler alerts: ACTIVE
Zero out flushed packets: INACTIVE
Flush stream on alert: INACTIVE
flush_data_diff_size: 500
Reassembler Packet Preferance : Favor Old
Packet Sequence Overlap Limit: -1
Flush behavior: Small (<255 bytes)
Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306
Emergency Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306
HttpInspect Config:
GLOBAL CONFIG
Max Pipeline Requests: 0
Inspection Type: STATELESS
Detect Proxy Usage: NO
IIS Unicode Map Filename: /etc/snort/unicode.map
IIS Unicode Map Codepage: 1252
DEFAULT SERVER CONFIG:
Ports: 80 8080 8180
Flow Depth: 300
Max Chunk Length: 500000
Inspect Pipeline Requests: YES
URI Discovery Strict Mode: NO
Allow Proxy Usage: NO
Disable Alerting: NO
Oversize Dir Length: 500
Only inspect URI: NO
Ascii: YES alert: NO
Double Decoding: YES alert: YES
%U Encoding: YES alert: YES
Bare Byte: YES alert: YES
Base36: OFF
UTF 8: OFF
IIS Unicode: YES alert: YES
Multiple Slash: YES alert: NO
IIS Backslash: YES alert: NO
Directory Traversal: YES alert: NO
Web Root Traversal: YES alert: YES
Apache WhiteSpace: YES alert: NO
IIS Delimiter: YES alert: NO
IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
Non-RFC Compliant Characters: NONE
rpc_decode arguments:
Ports to decode RPC on: 111 32771
alert_fragments: INACTIVE
alert_large_fragments: ACTIVE
alert_incomplete: ACTIVE
alert_multiple_requests: ACTIVE
telnet_decode arguments:
Ports to decode telnet on: 21 23 25 119
Portscan Detection Config:
Detect Protocols: TCP UDP ICMP IP
Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan
Sensitivity Level: Low
Memcap (in bytes): 10000000
Number of Nodes: 36900

X-Link2State Config:
Ports: 25 691
database: compiled support for ( mysql )
database: configured to use mysql
database: user = snort
database: password is set
database: database name = snort
database: host = localhost
database: sensor name = 66.199.228.17
database: sensor id = 1
database: schema version = 106
database: using the "log" facility
4024 Snort rules read...
4024 Option Chains linked into 205 Chain Headers
0 Dynamic rules
+++++++++++++++++++++++++++++++++++++++++++++++++++

Warning: flowbits key 'realplayer.playlist' is checked but not ever set.
Warning: flowbits key 'dce.bind.veritas' is set but not ever checked.
Warning: flowbits key 'smb.tree.create.llsrpc' is set but not ever checked.
Warning: flowbits key 'http.jpeg' is checked but not ever set.
Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set.

+-----------------------[thresholding-config]----------------------------------
| memory-cap : 1048576 bytes
+-----------------------[thresholding-global]----------------------------------
| none
+-----------------------[thresholding-local]-----------------------------------
| gen-id=1 sig-id=2275 type=Threshold tracking=dst count=5 seconds=60
| gen-id=1 sig-id=2924 type=Threshold tracking=dst count=10 seconds=60
| gen-id=1 sig-id=5323 type=Limit tracking=src count=1 seconds=60
| gen-id=1 sig-id=2494 type=Both tracking=dst count=20 seconds=60
| gen-id=1 sig-id=2523 type=Both tracking=dst count=10 seconds=10
| gen-id=1 sig-id=5321 type=Limit tracking=src count=1 seconds=60
| gen-id=1 sig-id=3152 type=Threshold tracking=src count=5 seconds=2
| gen-id=1 sig-id=2923 type=Threshold tracking=dst count=10 seconds=60
| gen-id=1 sig-id=2496 type=Both tracking=dst count=20 seconds=60
| gen-id=1 sig-id=3543 type=Threshold tracking=src count=5 seconds=2
| gen-id=1 sig-id=3527 type=Limit tracking=dst count=5 seconds=60
| gen-id=1 sig-id=5322 type=Limit tracking=src count=1 seconds=60
| gen-id=1 sig-id=2495 type=Both tracking=dst count=20 seconds=60
| gen-id=1 sig-id=3542 type=Threshold tracking=src count=5 seconds=2
| gen-id=1 sig-id=3273 type=Threshold tracking=src count=5 seconds=2
| gen-id=1 sig-id=4984 type=Threshold tracking=src count=5 seconds=2
+-----------------------[suppression]------------------------------------------
| none
-------------------------------------------------------------------------------
Rule application order: ->activation->dynamic->drop->alert->pass->log
Log directory = /var/log/snort

--== Initialization Complete ==--

,,_ -*> Snort! <*-
o" )~ Version 2.4.3 (Build 26)
'''' By Martin Roesch & The Snort Team: http://www.snort.org/team.html
(C) Copyright 1998-2005 Sourcefire Inc., et al.
NOTE: Snort's default output has changed in version 2.4.1!
The default logging mode is now PCAP, use "-K ascii" to activate
the old default logging mode.

===============================================================================

Snort received 277 packets
Analyzed: 266(96.029%)
Dropped: 11(3.971%)
===============================================================================
Breakdown by protocol:
TCP: 234 (84.477%)
UDP: 6 (2.166%)
ICMP: 2 (0.722%)
ARP: 22 (7.942%)
EAPOL: 0 (0.000%)
IPv6: 0 (0.000%)
ETHLOOP: 0 (0.000%)
IPX: 0 (0.000%)
FRAG: 0 (0.000%)
OTHER: 2 (0.722%)
DISCARD: 0 (0.000%)
===============================================================================
Action Stats:
ALERTS: 0
LOGGED: 0
PASSED: 0
===============================================================================
TCP Stream Reassembly Stats:
TCP Packets Used: 234 (84.477%)
Stream Trackers: 4
Stream flushes: 1
Segments used: 4
Stream4 Memory Faults: 0
===============================================================================
Final Flow Statistics
,----[ FLOWCACHE STATS ]----------
Memcap: 10485760 Overhead Bytes 16400 used(%0.171766)/blocks (18011/10)
Overhead blocks: 1 Could Hold: (58579)
IPV4 count: 9 frees: 0
low_time: 1138411959, high_time: 1138412056, diff: 0h:01:37s
finds: 243 reversed: 64(%26.337449)
find_sucess: 234 find_fail: 9
percent_success: (%96.296296) new_flows: 9
Protocol: 1 (%0.823045)
finds: 2
reversed: 0(%0.000000)
find_sucess: 0
find_fail: 2
percent_success: (%0.000000)
new_flows: 2
Protocol: 6 (%96.707819)
finds: 235
reversed: 63(%26.808511)
find_sucess: 233
find_fail: 2
percent_success: (%99.148936)
new_flows: 2
Protocol: 17 (%2.469136)
finds: 6
reversed: 1(%16.666667)
find_sucess: 1
find_fail: 5
percent_success: (%16.666667)
new_flows: 5
Frag3 statistics:
Total Fragments: 0
Frags Reassembled: 0
Discards: 0
Memory Faults: 0
Timeouts: 0
Overlaps: 0
Anomalies: 0
Alerts: 0
FragTrackers Added: 0
FragTrackers Dumped: 0
FragTrackers Auto Freed: 0
Frag Nodes Inserted: 0
Frag Nodes Deleted: 0
===============================================================================
database: Closing connection to database "
Snort exiting

Posted by seekyrr on February 01, 2006 17:07:39

i am having the same issue. Anyone have an answer for us?

Thanks!

D.

Posted by seekyrr on February 03, 2006 06:10:17

Seems I was not generating anything of interest. Changed log to alert and port scans showed up.

Next step is to generate some simulated attacks for testing.

Posted by campbellMac on February 03, 2006 18:21:42

Sorry to sound ignorant, but how did you do that? - Im very fresh to Snort and may need thorough instructions.

Many thanks in advance.
Campbell

Posted by R_b on June 18, 2006 10:06:39

I'm stuck here too. Any of you guys has resolved it yet?
Thanks

Posted by R_b on June 18, 2006 10:30:19

I'm stuck here too. Any of you guys has resolved it yet?
Thanks

Posted by sibi on June 20, 2006 04:06:38

Huh , atlast i got some company 4 me.
Me too waiting 4 an answer 4 dis issue.
I have dropd 2 posts in the forum.
mite b tattz not clear , anyhow dis is the prblm .
If u guys solved it , plz post it.
Thankz

Posted by Sureshb on June 20, 2006 07:13:24

I am also having the same issue.

Posted by jimbod on June 20, 2006 15:18:45

I am not sure exactally what seekyrr was refering too but you might want to check your output plugin for mysql. Here is mine.

output database: alert, mysql, host=localhost port=7788 dbname=snbase user=snort password=xxxxxxxx encoding=hex detail=full

Posted by sibi on June 21, 2006 02:05:26

r u getting log files in the log directory.
Coz previously i got log files instead of geting data in the db.
But now im not geting both . Please check and revert .

Posted by docjag on June 23, 2006 10:28:52

There was a new script released with some 2.6 RPMs that is really overblown for most systems. Try running it from the command line and see if you get any output. Just a guess.

Posted by pragsdale on August 11, 2006 07:20:13

For a quick way to test ports using a remote site use grc's shiels up page. When you use it you should see action on your log files in /var/log/snort/

it's at www.grc.com

Posted by pragsdale on August 11, 2006 07:44:20

You could also just do a quick nmap of your computer's ip address.