DBNAME = The database name that you shall use for Snort.
SNORTDBUSER = The snort db user that you shall use for Snort.
YOURPASSWORD = The password that you shall use for the Snort db user.

[email protected] ~]# mysql -p
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 40
Server version: 5.0.51a-24+lenny2 (Debian)

'help;'
أو

\c

mysql> CREATE DATABASE DBNAME;
Query OK, 1 row affected (0.00 sec)

mysql> GRANT CREATE, INSERT, SELECT, DELETE, UPDATE ON DBNAME.* TO
[email protected];
Query OK, 0 rows affected (0.00 sec)

mysql> SET PASSWORD FOR
[email protected]=PASSWORD('YOURPASSWORD');
Query OK, 0 rows affected (0.00 sec)

mysql> FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.00 sec)

mysql> exit
Bye

[[email protected] schemas]# cd schemas/

[[email protected] schemas]# mysql -p -u SNORTDBUSER DBNAME < create_mysql
Enter password:

[[email protected] schemas]# mysql -p
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 43
Server version: 5.0.51a-24+lenny2 (Debian)

mysql> show databases;
+--------------------+
| Database
|
+--------------------+
| information_schema |
| DBNAME
|
| mysql
|
+--------------------+
3 rows in set (0.00 sec)

mysql> use DBNAME;
Reading table information for completion of table and column names You can turn off this feature to
get a quicker startup with -A
Database changed

mysql> show tables;
+---------------------------+
| Tables_in_DBNAME |
+---------------------------+
| data
|
| detail
|
| encoding
|
| event
|
| icmphdr
|
| iphdr
|
| opt
|
| reference
|
| reference_system
|
| schema
|
| sensor
|
| sig_class
|
| sig_reference
|
| signature
|
| tcphdr
|
| udphdr
|
+---------------------------+
16 rows in set (0.00 sec)

mysql> exit
Bye

[[email protected] schemas]# snort -c /etc/snort/snort.conf

[ Port and Service Based Pattern Matching Memory ]
+-[AC-BNFA Search Info Summary]------------------------------
| Instances
: 284
| Patterns
: 23051
| Pattern Chars : 156930
| Num States
: 90782
| Num Match States : 12254
| Memory
: 3.87Mbytes
| Patterns
: 1.03M
| Match Lists : 1.43M
| Transitions : 1.30M
+-------------------------------------------------
--== Initialization Complete ==--
,,_ -*> Snort! <*-
o" )~ Version 2.8.5 (Build 106)
'''' By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
Copyright (C) 1998-2009 Sourcefire, Inc., et al.
Using PCRE version: 7.6 2008-01-28
Rules Engine: SF_SNORT_DETECTION_ENGINE Version 1.11 <Build 17>
Preprocessor Object: SF_DCERPC Version 1.1 <Build 5>
Preprocessor Object: SF_FTPTELNET Version 1.2 <Build 12>
Preprocessor Object: SF_SSLPP Version 1.1 <Build 3>
Preprocessor Object: SF_SSH Version 1.1 <Build 2>
Preprocessor Object: SF_SMTP Version 1.1 <Build 8>
Preprocessor Object: SF_DCERPC2 Version 1.0 <Build 2>
Preprocessor Object: SF_DNS Version 1.1 <Build 3>
Not Using PCAP_FRAMES

[[email protected] schemas]# chown snort:snort /var/log/snort/*****
[[email protected] schemas]# chmod 600 /var/log/snort/*****