Snort Forums Archive

Archive Home » Support » Do I need to be concerned about these database connectivity errors?

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

Do I need to be concerned about these database connectivity errors?

Posted by mmurphy on April 01, 2005 07:02:47

I am running snort on a windows 2000 box. It logs to a linux box running mysql/apache/base. I start snort on the win2k box with a batch file. After a while, I don't know what triggers it, the following error appears at the bottom of the dos window:

database: mysql_error: Lost connection to MySQL server during query
SQL=BEGIN

It seems to be logging everything just fine. Will snort just make a new connection when it needs to log something? Should I be concerned with this error?

Oh by the way. The logging information does pass through two firewalls before it gets to the mysql server if that makes a difference. And no, I haven't tried to log to a server on the same network, yet.

Posted by Elwood on April 19, 2005 05:26:41

I have this same problem in Win2k Professional running Snort 2.3.2 and mysql 4.1.11 on the localhost. It disconnects, but it seems that it reconnects since I often see multiple instances of this message. Power management? Nope checked that. Running snort as an application, not as a service at this point. It's a new setup so the DB isn't large (< 2500 total alerts).

Win2k is SP4 with all critical updates. P4 3.0 GHz, 512MB RAM, nothing fancy installed.

Also, do most people here use switches with SPAN ports or Taps?

Thanks.