164

Chapter 5     Using Snort with MySQL

This password is used in the snort.conf file along with the user name with

MySQL output module configuration. You have now set values for the following fields

of the MySQL output plug in in snort.conf file:

  Database name, which is snort

  Database user name which is rr

  Database user password which is rr78x

  The host where database server is running, which is the same machine where

Snort is installed. If both Database server and Snort are running on the same

machine, you will use  localhost  as the host name.

5.1.5

Step 5: Creating Tables in the Snort Database

After creating a database user and a Snort database, you now have to create the

tables required to store data in the database. Fortunately you can use the script

create_mysql in the contrib directory and it will create all of the necessary

tables for you. The contrib directory is present when you download Snort in the

source code form from its web site http://www.snort.org and extract its source files. The

create_mysql script is present along with other useful stuff in this directory. For

example, scripts to create database schema in other types of database servers are also

found in this directory.

The following command uses this script to create all database tables in the 

snort

database. 

[root@laptop]# mysql  h localhost  u rr  p snort < contrib/

create_mysql 

Enter password: 

[root@laptop]#

Different command line options are used with this command.

  The    h localhost  part of the command is used to tell the mysql client

that the database server is running on the same machine as the client.

  The    u rr  part is used to specify database user name to log into the

database server. This is the same user that you created previously. 

  The    p  part shows that you will enter the password for user rr in the next

line. 

  The   snort  part of the command line shows that the database that will be

used to create tables is  snort.