Hi all,
I used to using BASE + Snort 2.3.3 with a postgres sql
output
Everything worked fine
But yesterday, i used my master-snort-box to build
snort-box-children and then problems begun.
Some snort-boxes are placed before and after some
firewalls ( say s1 before and s2 after)
In the case an alert is received from s1 and then from
s2, (time delay is very short : <1ms ) it seems to
create a bug in the database :
Here is what snort says :
Jun 22 11:44:14 s3 snort: database: warning (SELECT
sig_id FROM signature WHERE sig_name = 'SNMP
missing community string attempt' AND sig_rev = 4
AND sig_sid = 1893 ) returned more than one result
Jun 22 11:44:14 s3 snort: database: warning (SELECT
sig_class_id FROM sig_class WHERE sig_class_name =
'misc-attack') returned more than one result
Jun 22 11:44:14 s3 snort: database: warning (SELECT
sig_class_id FROM sig_class WHERE sig_class_name =
'misc-attack') returned more than one result
Jun 22 11:44:14 s3 snort: database: unable to write
classification
Jun 22 11:44:14 s3 snort: database: warning (SELECT
sig_id FROM signature WHERE sig_name = 'SNMP
missing community string attempt' AND sig_rev = 4
AND sig_sid = 1893 ) returned more than one result
Jun 22 11:44:14 s3 snort: database: Problem inserting
a new signature 'SNMP missing community string
attempt'
Jun 22 11:44:14 s3 snort: database: warning (SELECT
ref_id FROM reference WHERE ref_system_id = 2
AND ref_tag = '1999-0517') returned more than one
result
Jun 22 11:44:14 s3 snort: database: warning (SELECT
ref_id FROM reference WHERE ref_system_id = 2
AND ref_tag = '1999-0517') returned more than one
result
Jun 22 11:44:14 s3 snort: database: Unable to insert
the alert reference into the DB
Jun 22 11:44:14 s3 snort: database: postgresql_error:
ERROR: duplicate key violates unique constraint
"sig_reference_pkey"
Jun 22 11:44:14 s3 snort: database: postgresql_error:
ERROR: current transaction is aborted, commands
ignored until end of transaction block
Jun 22 11:44:14 s3 snort: database: Unable to insert
unknown reference tag ('2112') used in rule.
Jun 22 11:44:14 s3 snort: database: postgresql_error:
ERROR: current transaction is aborted, commands
ignored until end of transaction block
The other snort is saying the same thing.
And as a matter of fact, in the table signature for
instance, i can see several entries for
:SELECT sig_id
:FROM signature
:WHERE sig_name = 'SNMP missing community string at
:tempt'
:AND sig_rev = 4
:AND sig_sid = 1893
I should have only one there
I've checked the spo_database.c from snort but as i'm
not a C addicted, i did not found error
The postgres logs confirms this bug :
ERROR: duplicate key violates unique constraint
"sig_reference_pkey"
ERROR: duplicate key violates unique constraint
"sig_reference_pkey"
ERROR: current transaction is aborted, commands
ignored until end of transaction block
ERROR: current transaction is aborted, commands
ignored until end of transaction block
ERROR: current transaction is aborted, commands
ignored until end of transaction block
ERROR: current transaction is aborted, commands
ignored until end of transaction block
ERROR: current transaction is aborted, commands
ignored until end of transaction block
ERROR: current transaction is aborted, commands
ignored until end of transaction block
I've already checked similar subjects on mailing
lists, but none helped
Each sensor is running in daemon mode
Each sensor is configured with a different sensor_name
in the output
All sensors have the same rules revision
Base scheme is built from create_postgresql from snort
sources
I've tried to purge the DB scheme and recreate this.
It works until i have only s1 running. When s2 is
running, it does not take long to generate errors
If a snort guru could have a look , i would be very
grateful since i'm in a real hurry to have this
project working.
Thanks for reading
___________________________________________________________________________
Appel audio GRATUIT partout dans le monde avec le nouveau Yahoo! Messenger
Téléchargez cette version sur http://fr.messenger.yahoo.com
-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
