Re: Snort missing mysql - Resolved

Cino · Jun 25, 2012, 10:25 AM

new snort build snort-2.9.2.3-i386.pbi 2012-Jun-23 18:19:29 wasn't compiled with mysql support


Jun 24 07:15:34 	SnortStartup[23880]: Interface Rule START for 0_39737_em3...
Jun 24 07:15:34 	barnyard2[6930]: FATAL ERROR: If this build of snort was obtained as a binary distribution (e.g., rpm, or Windows), then check for alternate builds that contains the necessary 'mysql' support. If this build of snort was compiled by you, then re-run the the ./configure script using the '--with-mysql' switch. For non-standard installations of a database, the '--with-mysql=DIR' syntax may need to be used to specify the base directory of the DB install. See the database documentation for cursory details (doc/README.database). and the URL to the most recent database plugin documentation.
Jun 24 07:15:34 	barnyard2[6930]: FATAL ERROR: If this build of snort was obtained as a binary distribution (e.g., rpm, or Windows), then check for alternate builds that contains the necessary 'mysql' support. If this build of snort was compiled by you, then re-run the the ./configure script using the '--with-mysql' switch. For non-standard installations of a database, the '--with-mysql=DIR' syntax may need to be used to specify the base directory of the DB install. See the database documentation for cursory details (doc/README.database). and the URL to the most recent database plugin documentation.
Jun 24 07:15:34 	barnyard2[6930]: database: 'mysql' support is not compiled into this build of snort
Jun 24 07:15:34 	barnyard2[6930]: database: 'mysql' support is not compiled into this build of snort

jimp · Jun 24, 2012, 2:44 PM

@Cino:

new snort build snort-2.9.2.3-i386.pbi 2012-Jun-23 18:19:29 wasn't compiled with mysql support


Jun 24 07:15:34 	SnortStartup[23880]: Interface Rule START for 0_39737_em3...
Jun 24 07:15:34 	barnyard2[6930]: FATAL ERROR: If this build of snort was obtained as a binary distribution (e.g., rpm, or Windows), then check for alternate builds that contains the necessary 'mysql' support. If this build of snort was compiled by you, then re-run the the ./configure script using the '--with-mysql' switch. For non-standard installations of a database, the '--with-mysql=DIR' syntax may need to be used to specify the base directory of the DB install. See the database documentation for cursory details (doc/README.database). and the URL to the most recent database plugin documentation.
Jun 24 07:15:34 	barnyard2[6930]: FATAL ERROR: If this build of snort was obtained as a binary distribution (e.g., rpm, or Windows), then check for alternate builds that contains the necessary 'mysql' support. If this build of snort was compiled by you, then re-run the the ./configure script using the '--with-mysql' switch. For non-standard installations of a database, the '--with-mysql=DIR' syntax may need to be used to specify the base directory of the DB install. See the database documentation for cursory details (doc/README.database). and the URL to the most recent database plugin documentation.
Jun 24 07:15:34 	barnyard2[6930]: database: 'mysql' support is not compiled into this build of snort
Jun 24 07:15:34 	barnyard2[6930]: database: 'mysql' support is not compiled into this build of snort

Not sure why but snort's build options were (And had always been) set to use WITHOUT_MYSQL. I changed that to WITH_MYSQL and a new build is running now. Will post again when it's up.

jimp · Jun 24, 2012, 6:14 PM

New snort build is up that should have it built in. Give it another go.

Cino · Jun 24, 2012, 7:39 PM

same issue.. I'll try again after the next build

timestamp reminder: snort-2.9.2.3-i386.pbi 2012-Jun-24 17:56:39

jimp · Jun 24, 2012, 7:44 PM

Did you uninstall and reinstall, or just click the 'pkg' button?

The latter doesn't remove the binaries and pull new ones, iirc.

jimp · Jun 24, 2012, 7:56 PM

Also, gitsync and try it once more, I noticed that some libs were going into subdirectories and weren't getting included how I thought they were.

Cino · Jun 24, 2012, 9:26 PM

having the same issue. Could it be that i'm using snort-dev and this change wasn't made to it? https://github.com/bsdperimeter/pfsense-packages/commit/81757da76ce52b9dd02ddccc5c7ba73100a6e6d0

they are using the same pbi file, so I thinking the same change should be made to snort-dev. Only difference right now is the xml code that i can tell from the 2 packages

jimp · Jun 25, 2012, 12:21 AM

Commit is inbound for that on snort-dev, I didn't touch snort dev initially.

rcfa · Jun 25, 2012, 10:18 AM

What's the difference between these two packages anyway? They seem to use the same version of everything.

And if I run the -dev package, will the configuration be forward/backwards compatible, or how does this work when at some point the two are merged or one replaces the other?

Cino · Jun 25, 2012, 10:22 AM

@jimp:

Commit is inbound for that on snort-dev, I didn't touch snort dev initially.

Thank you Jim! It fired right up after rule update