Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 04 Jul 2006 19:25:22 -0600
From:      =?ISO-8859-1?Q?C=E9sar_Amaya?= <csar@123.com.sv>
To:        =?ISO-8859-1?Q?C=E9sar_Amaya?= <csar@123.com.sv>
Cc:        freebsd-questions@freebsd.org
Subject:   Re: snort and mysql connection at start troubles
Message-ID:  <44AB1502.6050104@123.com.sv>
In-Reply-To: <44AAC413.6080907@123.com.sv>
References:  <44AA9A86.5000602@123.com.sv> <44AAA2DD.20108@daleco.biz> <44AAC413.6080907@123.com.sv>

next in thread | previous in thread | raw e-mail | index | archive | help
César Amaya wrote:
> Kevin Kinsey wrote:
>> César Amaya wrote:
>>> Hi list
>>>
>>> I am installing SNORT 2.4.5 to log into a MySQL-5.1 database. snort 
>>> logs are being stored fine into the db, but whe the system start 
>>> snort fails because of this: snort[396]: FATAL ERROR: database: 
>>> mysql_error: Can't connect to local MySQL server through socket 
>>> '/tmp/mysql.sock' (2)
>>>
>>> this is the configuration line in the snort.conf file
>>>
>>> output database: log, mysql, user=snortids password=PswIdS 
>>> dbname=snort host=localhost
>>>
>>> when I changed the 'localhost' name to 127.0.0.1 I got the following 
>>> error
>>>
>>> snort[401]: FATAL ERROR: database: mysql_error: Can't connect to 
>>> MySQL server on '127.0.0.1' (61)
>>>
>>> All of this happens at start time. After system started I start 
>>> snort manually and connect to mysql just fine.
>>>
>>> It seems that snort start earlier than mysql. I want to start mysql 
>>> earlier than snort but I don´t know how.
>>>
>>> Can some body help me?
>>>
>>
>> I think you should take a look at rcorder(8).
>>
>> Kevin Kinsey
>>
> I got mysql-server to start before snort
>
> proxy# rcorder /etc/rc.d/* /usr/local/etc/rc.d/*
> /usr/local/etc/rc.d/apache22.sh
> /etc/rc.d/DAEMON
> /etc/rc.d/LOGIN
> /usr/local/etc/rc.d/mysql-server
> /usr/local/etc/rc.d/snort
> /etc/rc.d/ypxfrd
>
> even though, I still have the same problem
> snort[471]: FATAL ERROR: database: mysql_error: Can't connect to local 
> MySQL server through socket '/tmp/mysql.sock' (2)
>
> Any thought?
>
I found out where the problem is. Like I said before, the thing is that 
mysql must start prior to snort, but mysql have no enough time to 
completely start. So I told this to my boss and then he told me to put a 
delay into the snort start file, and I did so.
I added the command /sleep 60 /in the first line of the snort start file 
and it worked just fine.

best regards!



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?44AB1502.6050104>