From owner-freebsd-questions@FreeBSD.ORG Wed Jul 5 01:24:49 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1331916A4E0 for ; Wed, 5 Jul 2006 01:24:49 +0000 (UTC) (envelope-from csar@123.com.sv) Received: from asgard1.americatelsal.com (asgard.americatelsal.com [200.13.161.7]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8481F43D46 for ; Wed, 5 Jul 2006 01:24:47 +0000 (GMT) (envelope-from csar@123.com.sv) Received: (qmail 13455 invoked from network); 5 Jul 2006 01:43:11 -0000 Received: from unknown (HELO ?192.168.10.251?) (200.13.161.68) by asgard1.americatelsal.com with SMTP; 5 Jul 2006 01:43:11 -0000 Message-ID: <44AB1502.6050104@123.com.sv> Date: Tue, 04 Jul 2006 19:25:22 -0600 From: =?ISO-8859-1?Q?C=E9sar_Amaya?= User-Agent: Thunderbird 1.5.0.4 (Windows/20060516) MIME-Version: 1.0 To: =?ISO-8859-1?Q?C=E9sar_Amaya?= References: <44AA9A86.5000602@123.com.sv> <44AAA2DD.20108@daleco.biz> <44AAC413.6080907@123.com.sv> In-Reply-To: <44AAC413.6080907@123.com.sv> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit Cc: freebsd-questions@freebsd.org Subject: Re: snort and mysql connection at start troubles X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Jul 2006 01:24:49 -0000 César Amaya wrote: > Kevin Kinsey wrote: >> César Amaya wrote: >>> Hi list >>> >>> I am installing SNORT 2.4.5 to log into a MySQL-5.1 database. snort >>> logs are being stored fine into the db, but whe the system start >>> snort fails because of this: snort[396]: FATAL ERROR: database: >>> mysql_error: Can't connect to local MySQL server through socket >>> '/tmp/mysql.sock' (2) >>> >>> this is the configuration line in the snort.conf file >>> >>> output database: log, mysql, user=snortids password=PswIdS >>> dbname=snort host=localhost >>> >>> when I changed the 'localhost' name to 127.0.0.1 I got the following >>> error >>> >>> snort[401]: FATAL ERROR: database: mysql_error: Can't connect to >>> MySQL server on '127.0.0.1' (61) >>> >>> All of this happens at start time. After system started I start >>> snort manually and connect to mysql just fine. >>> >>> It seems that snort start earlier than mysql. I want to start mysql >>> earlier than snort but I don´t know how. >>> >>> Can some body help me? >>> >> >> I think you should take a look at rcorder(8). >> >> Kevin Kinsey >> > I got mysql-server to start before snort > > proxy# rcorder /etc/rc.d/* /usr/local/etc/rc.d/* > /usr/local/etc/rc.d/apache22.sh > /etc/rc.d/DAEMON > /etc/rc.d/LOGIN > /usr/local/etc/rc.d/mysql-server > /usr/local/etc/rc.d/snort > /etc/rc.d/ypxfrd > > even though, I still have the same problem > snort[471]: FATAL ERROR: database: mysql_error: Can't connect to local > MySQL server through socket '/tmp/mysql.sock' (2) > > Any thought? > I found out where the problem is. Like I said before, the thing is that mysql must start prior to snort, but mysql have no enough time to completely start. So I told this to my boss and then he told me to put a delay into the snort start file, and I did so. I added the command /sleep 60 /in the first line of the snort start file and it worked just fine. best regards!