aaron.wayne@hpe1 Absent Member.
Absent Member.
334 views

Snort db smart connector not working

I am getting the following error I verified permissions and can login without issue from the machine the smart connector is currently installed on.  So I can hit the db via manual login to the mysql db snort and get a version string. 

[INFO] Embedded - Starting tomcat server

[INFO] StandardEngine - Starting Servlet Engine: Apache Tomcat/5.5.33

[INFO] StandardHost - XML validation disabled

[INFO] ContextConfig - No default web.xml

[INFO] Http11BaseProtocol - Initializing Coyote HTTP/1.1 on http-localhost%2F127.0.0.1-10001

[INFO] Http11BaseProtocol - Starting Coyote HTTP/1.1 on http-localhost%2F127.0.0.1-10001

[Tue Jun 25 20:06:50 CDT 2013] [INFO ] Initializing Agent Framework Version [6.0.3.6664.0]

[Tue Jun 25 20:06:51 CDT 2013] [INFO ] Memory monitor started, heap limit: 240.0 MB

[Tue Jun 25 20:06:51 CDT 2013] [INFO ] Initializing agent flow for destination [<?xml version="1.0" encoding="UTF-8"?>

<ParameterValues>

    <Parameter Name="port" Value="8443"/>

    <Parameter Name="host" Value="192.168.1.166"/>

    <Parameter Name="aupmaster" Value="false"/>

    <Parameter Name="filterevents" Value="false"/>

    <Parameter Name="fipsciphers" Value="fipsDefault"/>

</ParameterValues>

]

[GC 98304K->6606K(245760K), 0.0273860 secs]

[Tue Jun 25 20:06:51 CDT 2013] [WARN ] Cache files were found for cache [TC_3qFlTaD8BABCEY7m7ultufQ==] but the cache size is missing or is negative. Scanning Cache now, this may take a while...(to avoid this step and use the cache size [0] set the property [eventcache.scanforsize] to 'false')

[Tue Jun 25 20:06:51 CDT 2013] [INFO ] Cache size [0]. Scanned in [1] ms.

[Tue Jun 25 20:06:51 CDT 2013] [INFO ] Zone based filtering disabled.

[Tue Jun 25 20:06:51 CDT 2013] [WARN ] Cache files were found for cache [3qFlTaD8BABCEY7m7ultufQ==.m1] but the cache size is missing or is negative. Scanning Cache now, this may take a while...(to avoid this step and use the cache size [0] set the property [eventcache.scanforsize] to 'false')

[Tue Jun 25 20:06:51 CDT 2013] [INFO ] Cache size [0]. Scanned in [0] ms.

[Tue Jun 25 20:06:51 CDT 2013] [INFO ] HTTP Compression enabled.

FATAL EXCEPTION:

java.lang.UnsupportedOperationException: Unable to detect database version.

Tried version [1.8]. ERROR: [Access denied for user 'snort'@'192.168.1.166' (using password: YES)]

Tried version [2.6]. ERROR: [Access denied for user 'snort'@'192.168.1.166' (using password: YES)]

Tried version [2.6]. ERROR: [Access denied for user 'snort'@'192.168.1.166' (using password: YES)]

Tried version [1.8]. ERROR: [Access denied for user 'snort'@'192.168.1.166' (using password: YES)]

    at com.arcsight.agent.sdk.a.c.g.a(g.java:652)

    at com.arcsight.agent.sdk.a.c.g.b(g.java:584)

    at com.arcsight.agent.sdk.a.c.g.e(g.java:351)

    at com.arcsight.agent.xe.c.c.e(c.java:209)

    at com.arcsight.agent.Agent.b(Agent.java:634)

    at com.arcsight.agent.Agent.a(Agent.java:1053)

    at com.arcsight.agent.Agent.e(Agent.java:881)

    at com.arcsight.agent.Agent.main(Agent.java:1757)

Exception in thread "AgentStats" java.lang.NullPointerException

    at com.arcsight.agent.cg.m.b(m.java:143)

    at com.arcsight.agent.ii.a(ii.java:775)

    at com.arcsight.agent.ii.a(ii.java:359)

    at com.arcsight.agent.ii.k(ii.java:499)

    at com.arcsight.agent.ii.run(ii.java:798)

[Tue Jun 25 20:06:52 CDT 2013] [INFO ] Agent upgrade status check thread started


Labels (2)
0 Likes
Reply
1 Reply
Highlighted
aaron.wayne@hpe1 Absent Member.
Absent Member.

Re: Snort db smart connector not working

nevermind the problem was I had multiple users created for snort so I removed all the users and created one use

grant insert,select on root.* to 'snort'@'%';

set password for 'snort'@'%'=password('mypassword');

grant create,delete,insert,select,update on snort.* to 'snort'@'%';

grant create,delete,insert,select,update on snort.* to snort;


The % denotes any host

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.