snort 2.8 with mysql support from OpenSUSE

I downloaded the bundled package from the repository on opensuse.org for snort and mysql (i believe it just has mysql support built in not mysql install) well it is installed but i can’t seem to find the create_mysql that sets up the schema in the db. I’ve looked through the documentation but nothing really references that.

If someone has a good setup doc that would be great.

Don’t know about snort. But MySQL support probably needs MySQL to be installed, incl. libmysqlclient. Install those through Yast - Software management, try again and get back to us with results. You might need it to run as a service.

Good luck.

You made no mention of where you got it from if you have snort-mysql (2.8.4.1) it is compiled with mysql support now having had a looked inside the rpm it seems to only install /usr/sbin/snort-mysql.

If you get the src.rpm you can find the bits inside you want I could paste it up but I’m sure here you would prefer to get it from the horses mouth :wink:

You need from the tar.bz2 /doc/README.database
and /schemas/create_mysql

If from monitoring src.rpm here Index of /repositories/server:/monitoring/openSUSE_11.1/src Strange it isn’t included I may end up being corrected but doesn’t look like its inside snort-mysql.

Thanks Feathermonkey, i have it all installed now and with the help of some Man pages it’s running and logging to the dbase.

time to get Base up and running, thanks for your help.