OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
RE: [Snort-users] Are there known bugs in the odbc output plugin WRT FreeTDS and unixODBC? (more debug info)

From: McCash, John (John.McCashandrew.com)
Date: Thu Apr 29 2004 - 09:28:24 CDT

Well, I've got another update, but I'm seriously finding moss on both sides of the trees now...

I tried configuring freeTDS to use different versions of the TDS protocol. No difference with 7.0, but when I tried 4.2, it got past the point where it was breaking. But then it ran smack into some other issue. Now I get the following snort error on startup (using any TDS protocol version):

Apr 29 09:11:18 aopsecurityserver snort: FATAL ERROR: database: The underlying database has not been initialized correctly. This
        version of Snort requires version 106 of the DB schema. Your DB doesn't appear to have any records in the 'schema
' table. Please re-run the appropriate DB creation script (e.g. create_mysql, create_postgresql, create_oracle,
create_mssql) located in the contrib\ directory. See the database documentation for cursory details (doc/README
.database). and the URL to the most recent database plugin documentation.
Apr 29 09:11:18 aopsecurityserver kernel: device eth0 left promiscuous mode

Mind you, the database is, in fact, correctly configured, as I can tell from the Windows side. However when I try to run 'SELECT vseq from schema' in isql, I get the following error:

SQL> select vseq from schema
[][unixODBC][FreeTDS][SQL Server]Statement(s) could not be prepared.
[][unixODBC][FreeTDS][SQL Server]Incorrect syntax near the keyword 'schema'.
[ISQL]ERROR: Could not SQLExecute

But if I do 'SELECT vseq from "schema"', it works fine... But only under TDS versions 7.0 or 8.0... Under 4.2, I get:

SQL> select vseq from "schema"
[37000][unixODBC][FreeTDS][SQL Server]Line 1: Incorrect syntax near 'schema'.
[ISQL]ERROR: Could not SQLExecute

Does anybody know if this is relevant to the problem?

                Thanks
                        John
------------------------------------------------------------------------------------------------
This message is for the designated recipient only and may
contain privileged, proprietary, or otherwise private information.
If you have received it in error, please notify the sender
immediately and delete the original. Any unauthorized use of
this email is prohibited.
------------------------------------------------------------------------------------------------
[mf2]

-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g.
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id149&alloc_id66&op ick
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users