[root@snort ~]# snort -c /etc/snort/snort.conf
Running in IDS mode

--== Initializing Snort ==--
Initializing Output Plugins!
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file "/etc/snort/snort.conf"
PortVar 'HTTP_PORTS' defined : [ 80 2301 3128 7777 7779 8000 8008 8028 8080 8180 8888 9999 ]
PortVar 'SHELLCODE_PORTS' defined : [ 0:79 81:65535 ]
PortVar 'ORACLE_PORTS' defined : [ 1521 ]
Detection:
Search-Method = AC-BNFA-Q
Tagged Packet Limit: 256
Loading dynamic engine /usr/local/lib/snort_dynamicengine/libsf_engine.so... done
Loading all dynamic preprocessor libs from /usr/local/lib/snort_dynamicpreprocessor/...
Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_ftptelnet_preproc.so... done
Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_dcerpc_preproc.so... done
Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_smtp_preproc.so... done
Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_ssh_preproc.so... done
Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_sdf_preproc.so... done
Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_dns_preproc.so... done
Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_ssl_preproc.so... done
Loading dynamic preprocessor library /usr/local/lib/snort_dynamicpreprocessor//libsf_dce2_preproc.so... done
Finished Loading all dynamic preprocessor libs from /usr/local/lib/snort_dynamicpreprocessor/
Log directory = /var/log/snort
database: must enter database name in configuration file


USAGE: database plugin

output database: [log | alert], [type of database], [parameter list]

[log | alert] selects whether the plugin will use the alert or
log facility.

For the first argument, you must supply the type of database.
The possible values are mysql, postgresql, odbc, oracle and
mssql
The parameter list consists of key value pairs. The proper
format is a list of key=value pairs each separated a space.

The only parameter that is absolutely necessary is "dbname".
All other parameters are optional but may be necessary
depending on how you have configured your RDBMS.

dbname - the name of the database you are connecting to

host - the host the RDBMS is on

port - the port number the RDBMS is listening on

user - connect to the database as this user

password - the password for given user

sensor_name - specify your own name for this snort sensor. If you
do not specify a name one will be generated automatically

encoding - specify a data encoding type (hex, base64, or ascii)

detail - specify a detail level (full or fast)

ignore_bpf - specify if you want to ignore the BPF part for a sensor

definition (yes or no, no is default)

FOR EXAMPLE:
The configuration I am currently using is MySQL with the database
name of "snort". The user "snortusr@localhost" has INSERT and SELECT
privileges on the "snort" database and does not require a password.
The following line enables snort to log to this database.

output database: log, mysql, dbname=snort user=snortusr host=localhost

ERROR: Fatal Error, Quitting..

database: must enter database name in configuration file

output database: log, mysql, dbname=snort user=snortusr password=123456 host=localhost

4. Tạo CSDL snort với MySQL

 

            #service mysqld start

Trước tiên ta cần set password cho root trong MySQL.

            #mysqladmin -u root password 123456

            #mysql -p

 

Tạo password cho tài khoản snort.

 

            mysql> use mysql;

            mysql> CREATE USER 'snort'@'localhost' IDENTIFIED BY '123456';

   

Tạo CSDL cho snort.

            mysql> create database snort;

            mysql> GRANT CREATE, INSERT, SELECT, DELETE, UPDATE ON snort.* to snort@localhost;

            mysql> flush privileges;

            mysql> exit

Tạo các table từ /snort/snort-2.8.4.1/schemas/create_mysql cho database snort (thư mục gải nén snort)

            mysql -u root -p < /snort/snort-2.8.4.1/schemas/create_mysql snort

            mysql -p

            show databases;

            use snort;

            show tables;

            Quan sát các tables