No Data in BASE 1.4.1

2009-03-26
2013-06-03
  • James Byrnes
    James Byrnes
    2009-03-26

    Hello;
    I have a fresh install of Snort 2.8.3.2 with Mysql, Barnyard, Base 1.4.1, and Ntop running on CentOS5.2. I have ssnort up and running with 2 NICs Eth3-monitoring and Eth1-sniffing and have followed the testing procedure posted by Juergen Leising on 2008-6-26, which is listed below:

    1. Can snort detect anything ? I ran snort -vde -i eth1 -n 50
    packets received on screen.

    2. Is snort.conf syntactically correct? I ran snort -T -cc /etc/snort

    Snort successfully loaded all rules and rule chains.

    3. Can snort qualify some of the observed data as alerts?
       I ran snort in ids mode snort -vde -i eth1 -L snort.pcap -c /etc/snort.conf -n 100

    Data received on screen

    4. Does snort trigger any alerts at all?
    looked in /var/log/messages 
    Alerts are posting and barnyard is processing them

    5. Is the database syntactically ok? I ran mysqlcheck --check snort -u snort  -p
    All checked ok

    6. Do any packets show up in mysql database?
    mysql> select * from event where timeswtamp like '%2009-03-26%';

    The responce was 1663 rows in 1 set (Data is present)

    The Base webpage is up and wants to be active but it appears to not be reading the data on sensor my Sensor/Total is 0/0
    all data is 0. I would like to get this up and running any
    assistance would be appreciated.

     
    • Paul Schmehl
      Paul Schmehl
      2009-03-28

      Did you run the mysql script that came with BASE so that the database tables were created for BASE?

      What do you get when you type "select * from acid_event limit 5;"

       
    • I'm having the same problem.

      +------------------+
      | Tables_in_snort  |
      +------------------+
      | acid_ag          |
      | acid_ag_alert    |
      | acid_event       |
      | acid_ip_cache    |
      | base_roles       |
      | base_users       |
      | data             |
      | detail           |
      | encoding         |
      | event            |
      | icmphdr          |
      | iphdr            |
      | opt              |
      | reference        |
      | reference_system |
      | schema           |
      | sensor           |
      | sig_class        |
      | sig_reference    |
      | signature        |
      | tcphdr           |
      | udphdr           |
      +------------------+
      22 rows in set (0.00 sec)

      Current database: snort
      mysql> select count(*) from event;
      +----------+
      | count(*) |
      +----------+
      |       75 |
      +----------+
      1 row in set (0.00 sec)

      mysql>

      yet Base shows nothing at all.