Tuesday, December 21, 2010

Snort is not logging data to Database while running as Service.

The very important point in the troubleshooting of snort is always prefer to start it with the command line parameters b'cos  when you are starting it with the command lines it will display the complete trace of the commands in which we can figure out like the Ethernet Details if more then 1 ethernet cards are available on the server.

Snort as service is pointing a particular Ethernet and when u are explicitly defining in start commands you may be giving a different Ethernet details so, this is the root cause that why your snort is not logging into the database when running snort as windows/linux service

this can be verified by using the comand line params as shown below and try to run the snort also thro' the service and findout the difference.in my case the correct interface id is 1 and this can be verified by using below commands.

Check available Ethernet Cards
snort -W












Start snort in Verbose logging mode
snort -v -i1 -c D:\snort\etc\snort.conf -l D:\snort\log -K ascii













Installing / Uninstalling Snort as windows service
snort /SERVICE /INSTALL  -i1 -c D:\snort\etc\snort.conf -l D:\snort\log -K ascii

No comments:

Post a Comment