For those interested, i made a patch for
spo_database.c to correct this issue
AFAIK, two bugs where presents :
1 - In postgres output, the return value from Select
is 0 if there are multiple tuples. Therefore, it
inserts in DB each time a 1+ tuple is returned. This
bug seems to not be present in the mysql output.
For this bug, i only give the select return value to
result.
2 - Bug (1) does not resolve the fact that several
request can be done simultaneously before the sensor
commit. Thus, multiple entries can be inserted the
first time an alert is being seen.
I corrected this bug by using a delay timer before
making a checking Select. This timer is depending from
hostname so ********* IT ONLY APPLY TO HOSTNAME =
[A-Za-z][0-9]* in regexp *****************
This is the diff file for spo_database.c
55a56
#include <unistd.h>
247a249
char TimeFactor[4]="";
350a353,355
/* Using part of sensorname to generate a
delay_variable */
strcpy(TimeFactor,(char *)escapedSensorName+1);
2249a2255,2256
/* Whatever the result is, we return
the real value and not 0 if it's >1 */
/* If return=0 when result>1 it
inserts many alerts references tuples in DB */
2253d2259
< result = 0;
2255,2258c2261
< else
< {
< result =
atoi(PQgetvalue(data->p_result,0,0));
< }
---
result =
atoi(PQgetvalue(data->p_result,0,0));
2267a2271,2285
/* In case no result is received, we
insert a delay depending on hostname to prevent */
/* two snorters or more to insert
simultaneously in database. 100 milliseconds should */
/* be enough to have the first snort
insert and commit before the second doing select */
else
{
usleep(100000*atoi(TimeFactor));
data->p_result =
PQexec(data->p_connection,query);
if((PQresultStatus(data->p_result) ==
PGRES_TUPLES_OK))
{
if(PQntuples(data->p_result))
{
result =
atoi(PQgetvalue(data->p_result,0,0));
}
}
}
___________________________________________________________________________
Appel audio GRATUIT partout dans le monde avec le nouveau Yahoo! Messenger
Téléchargez cette version sur http://fr.messenger.yahoo.com
-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
