[Snort-inline-users] MySQL static snort_inline compilation

[William M. <Wil...@kc...>]

Rob,

A while ago I asked you how to statically compile snort_inline with mys=
ql
support, due to your busy schedule you told me to send you an e-mail If=
 I
every figured out how to make it work.  I finally got this to work by
changing the linking order of the libraries and re-running the last lin=
e of
make.  The key is that you must have the libz libraries, and these must=
 go
after the linking of  -lmysqlclient.  The default linking order is

-libq -lz -lpcre -lpcap -lm -lnsl -lmysqlclient -lnet

This needs to be changed to something like

-libq  -lpcre -lpcap -lm -lnsl -lmysqlclient -lz -lnet -static

and then re-running the last line from make from in the src directory

The following produces src/snort_inline

/usr/pp/bin/gcc -fstack-protector  -g -O2 -Wall -DGIDS -D_BSD_SOURCE
-D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -DLIBNET_LIL_ENDIAN
-L/usr/local/lib -lpcre -L/usr/lib -o snort_inline  codes.o debug.o
decode.o log.o mstring.o parser.o plugbase.o snort.o snprintf.o strlcat=
u.o
strlcpyu.o tag.o ubi_BinTree.o ubi_SplayTree.o util.o detect.o signatur=
e.o
mempool.o sf_sdlist.o fpcreate.o fpdetect.o pcrm.o byte_extract.o
sfthreshold.o inline.o packet_time.o event_wrapper.o
output-plugins/libspo.a detection-plugins/libspd.a preprocessors/libspp=
.a
preprocessors/flow/portscan/libportscan.a preprocessors/flow/libflow.a
parser/libparser.a preprocessors/HttpInspect/libhttp_inspect.a
sfutil/libsfutil.a -lipq -lpcre -lpcap -lm -lnsl -lmysqlclient -lz -lne=
t
-static

snort_inline: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV),=
 for
GNU/Linux 2.0.30, statically linked, not stripped

The statically compiled executable can log to mysql and drop packets li=
ke a
champ......

Regards,

Will=