Intrusion Detection: Snort, Base, MySQL, and Apache2 On Ubuntu 7.10

I'm experiencing problems with the howto: Intrusion Detection: Snort, Base, MySQL, and Apache2 On Ubuntu 7.10 (Gutsy Gibbon) (Updated)
In the beginning everything runs fine but after a while I saw that snort doesnt write anything to the mysql database anymore.
In the daemon.log file I see following error message:
snort[4350]: database: mysql_error: MySQL server has gone away SQL=BEGIN

Anyone has an idea on how to solve this?

Thx in advance

Tokke

 

This seems to be a bug in snort not a mysql problem.

http://www.snort.org/archive-1-3159.html

 

Sorry my BAD it is a mysql problem that can be fixed with this

Code:

[mysqld]
#
wait_timeout = 604800
interactive_timeout = 604800

in your my.cnf

The restart mysqld.

 

Thx for the quick reply.
I changed the values. No I have to wait to see if it still works after a few days.

 

This didn't solve the problem. I have the same error again.
Anymore ideas?

Best regards

Tokke

 

I think then it is a snort problem, from what i have picked up the snort connection does not interact with mysql in time that is why that fix was to allow for a longer time out on the client sending data to the mysql server.

Check if you are running the latests snort it could have been fixed in a newer release.