Snort MySQL error "database: must enter database name in configuration file#012"

in /etc/snort/database.conf, modify the line

output database: log, mysql

to

output database: log, mysql, user=snort password=<your pass> dbname=snort host=localhost 

My self note on Snort + MySQL on Ubuntu

Enable the root login first.

Stop the mysql service

Invoke :
mysqld_safe --skip-grant-tables &

Update password for root
use mysql;
update user set password=PASSWORD("testpass") where User='root';
flush privileges;

restart mysql normally

Snort:

create database snort;
use snort;
grant all privileges on snort.* to 'snort'@'localhost' identified by 'passwordbaru'
flush privileges;

Will be updated from time to time if needed


Should get this:


mysql> show tables;
+------------------+
| Tables_in_snort  |
+------------------+
| data             |
| detail           |
| encoding         |
| event            |
| icmphdr          |
| iphdr            |
| opt              |
| reference        |
| reference_system |
| schema           |
| sensor           |
| sig_class        |
| sig_reference    |
| signature        |
| tcphdr           |
| udphdr           |
+------------------+
16 rows in set (0.00 sec)