I'm experiencing problems with the howto: Intrusion Detection: Snort, Base, MySQL, and Apache2 On Ubuntu 7.10 (Gutsy Gibbon) (Updated) In the beginning everything runs fine but after a while I saw that snort doesnt write anything to the mysql database anymore. In the daemon.log file I see following error message: snort[4350]: database: mysql_error: MySQL server has gone away SQL=BEGIN Anyone has an idea on how to solve this? Thx in advance Tokke
Sorry my BAD it is a mysql problem that can be fixed with this Code: [mysqld] # wait_timeout = 604800 interactive_timeout = 604800 in your my.cnf The restart mysqld.
Thx for the quick reply. I changed the values. No I have to wait to see if it still works after a few days.
I think then it is a snort problem, from what i have picked up the snort connection does not interact with mysql in time that is why that fix was to allow for a longer time out on the client sending data to the mysql server. Check if you are running the latests snort it could have been fixed in a newer release.