LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware
User Name
Password
Slackware This Forum is for the discussion of Slackware Linux.

Notices


Reply
  Search this Thread
Old 06-01-2005, 10:21 AM   #1
Dr. Psy
Member
 
Registered: May 2005
Distribution: Slackware 10.1
Posts: 49

Rep: Reputation: 15
Snort, MySQL and ACID


I have used Snort for quite some time now, and am very happy with it.

Recently, I decided to give MySQL logging with the ACID console a try.

I got mysql up and running just fine and created the snort database. Followed the instructions for ACID, and went to http://localhost/ACID/ . In the instructions, I was told that I would find a link to create the ACID table. However, when I went to that address, I got nothing except the contents of acid_main.php

I should mention that I have NEVER used PHP in my life. I have always used CGI, so I know nothing about PHP at all. (which seems to be the source of the problem.)

I was told to add

AddType application/x-httpd-php .php

to httpd.conf. Tryed that, no luck

I tried uncommenting the line in httpd.conf that contains

#Include /etc/apache/mod_php.conf

no luck.

There is a file in /etc/apache called mod_php.conf, which contains

#
# mod_php - PHP Hypertext Preprocessor module
#

# Load the PHP module:
LoadModule php4_module libexec/apache/libphp4.so

# Tell Apache to feed all *.php files through the PHP module:
AddType application/x-httpd-php .php

# This will display PHP files in colored syntax form. Use with caution.
#AddType application/x-httpd-php-source .phps

So I tried all these different things, trying to get ACID working (actually any PHP script!...tried several others also, to make sure it wasnt an ACID specific problem.) and depending on what I did, I either got the contents of the file (the source code-so to speak) or I got a download popup window, asking me if I wanted to save the file to disk.

I also ran into a problem at some point (with one particular configuration, that when I went to http://localhost/ACID/, it returned an error about about not being able to load libphp4.so, something about (ACID?) being compiled with a different version, and that they must match...I have no idea!

I have used Linux in general and Slackware in particular for a long time now, and consider myself very linux literate. So I feel completely stupid in this case, because I just can not seem to get this working no matter what I do!

I used Google extensively to try to solve the problem, and found nothing of relevance.

So apparently, there is something that I am totally NOT getting! I'm sure it's something simple (it always is!), but I am unable to figure it out!

Does anyone have ANY information on this that might help?

Thanks a bunch.
 
Old 06-01-2005, 10:35 AM   #2
keefaz
LQ Guru
 
Registered: Mar 2004
Distribution: Slackware
Posts: 6,552

Rep: Reputation: 872Reputation: 872Reputation: 872Reputation: 872Reputation: 872Reputation: 872Reputation: 872
The only thing to do in httpd.conf is uncomment the line :
#Include /etc/apache/mod_php.conf

Then, go into /etc/rc.d and :
./rc.httpd start (or restart if it is already started)

Last edited by keefaz; 06-01-2005 at 10:36 AM.
 
Old 06-01-2005, 01:25 PM   #3
Dr. Psy
Member
 
Registered: May 2005
Distribution: Slackware 10.1
Posts: 49

Original Poster
Rep: Reputation: 15
Ok. Did that, and here is the output of my php scripts

PHP Warning: Unknown(): Unable to load dynamic library '/usr/lib/php/extensions/mysql.so' - /usr/lib/php/extensions/mysql.so: undefined symbol: OnUpdateLong in Unknown on line 0
PHP Warning: Unknown(): (null): Unable to initialize module
Module compiled with module API=20041030, debug=0, thread-safety=0
PHP compiled with module API=20020429, debug=0, thread-safety=0
These options need to match
in Unknown on line 0
HTTP/1.1 200 OK
Date: Wed, 01 Jun 2005 11:19:13 GMT
Server: Apache
X-Powered-By: PHP/4.3.11
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
 
Old 06-01-2005, 01:46 PM   #4
keefaz
LQ Guru
 
Registered: Mar 2004
Distribution: Slackware
Posts: 6,552

Rep: Reputation: 872Reputation: 872Reputation: 872Reputation: 872Reputation: 872Reputation: 872Reputation: 872
Make sure you use mysql, php and apache compatible packages
 
Old 06-01-2005, 02:12 PM   #5
Dr. Psy
Member
 
Registered: May 2005
Distribution: Slackware 10.1
Posts: 49

Original Poster
Rep: Reputation: 15
What do you mean exactly? PHP, Apache and MySQL are already installed in Slackware. ACID is set up to use with snort, and mysql. Snort is properly logging to MySQL. The only thing that isnt working is the ACID PHP scripts. Actually, ANY PHP scripts! They are all returning the error above. I dont get it!
 
Old 06-01-2005, 02:43 PM   #6
Dr. Psy
Member
 
Registered: May 2005
Distribution: Slackware 10.1
Posts: 49

Original Poster
Rep: Reputation: 15
How weird! I removed php.ini from /etc/apache, and now suddenly all my php scripts work! Go figure. I would have never guessed, had it not been for trying every damn thing else! Geez!

But When logging into ACID, it now informs me that the prebuilt Slackware PHP was not configured with mysql support. Geez! So, I have to recompile PHP!

Oh well, at least I am finally up and running!
 
Old 06-01-2005, 03:13 PM   #7
Dr. Psy
Member
 
Registered: May 2005
Distribution: Slackware 10.1
Posts: 49

Original Poster
Rep: Reputation: 15
Ok, damnit! This is really getting frusterating!

I downloaded the newest version of php and configured with ./configure --with-mysql and installed

Went to the ACID URL, and again, I got the same message

PHP ERROR: PHP build incomplete: the prerequisite MySQL support required to read the alert database was not built into PHP. Please recompile PHP with the necessary library (--with-mysql)

Well, thats exatly what I did!

I placed the php.ini file back into /etc/apache, and I got the exact same eroor as I posted above.

So, PHP IS working (other non-mysql scripts work fine) I recompiled PHP with mysql support, and I am still getting the above message.

When I put the php.ini file (which contains the line to Load the mysql module) I get the error message about

PHP Warning: Unknown(): Unable to load dynamic library '/usr/lib/php/extensions/mysql.so' - /usr/lib/php/extensions/mysql.so: undefined symbol: OnUpdateLong in Unknown on line 0
PHP Warning: Unknown(): (null): Unable to initialize module
Module compiled with module API=20041030, debug=0, thread-safety=0
PHP compiled with module API=20020429, debug=0, thread-safety=0
These options need to match
in Unknown on line 0


Can anyone give me ANY inside into this??? Geez!
 
Old 06-01-2005, 04:17 PM   #8
Dr. Psy
Member
 
Registered: May 2005
Distribution: Slackware 10.1
Posts: 49

Original Poster
Rep: Reputation: 15
Ok, according to this page http://us2.php.net/mysql , the --with-mysql option is enabled by default in PHP4, but not in 5. Slackware 10.1 includes PHP 4.3(?) I think. So I got rid of the PHP 4, and replaced with the original Slackware 4.3, so mysql support IS there. Again, PHP is working fine. Snort is logging to mysql fine. The only problem now, is that when I run ACID , it returns the error

PHP ERROR: PHP build incomplete: the prerequisite MySQL support required to read the alert database was not built into PHP. Please recompile PHP with the necessary library (--with-mysql)

That is with the php.ini file REMOVED from /etc/apache.

And when I put the file PHP.ini BACK into /etc/apache (which contains the line

; Load the MySQL module by default. Comment this out if you don't use MySQL.
extension=mysql.so

and then go to the ACID console, it says

PHP Warning: Unknown(): Unable to load dynamic library '/usr/lib/php/extensions/mysql.so' - /usr/lib/php/extensions/mysql.so: undefined symbol: OnUpdateLong in Unknown on line 0
PHP Warning: Unknown(): (null): Unable to initialize module
Module compiled with module API=20041030, debug=0, thread-safety=0
PHP compiled with module API=20020429, debug=0, thread-safety=0
These options need to match
in Unknown on line 0

So, it seems to have something to do with the mysql.so extension. But I can't figure out WHAT the problem is. Especially since MySQL and PHP are part of the Slackware installation!
 
Old 06-01-2005, 04:51 PM   #9
gbonvehi
Senior Member
 
Registered: Jun 2004
Location: Argentina (SR, LP)
Distribution: Slackware
Posts: 3,145

Rep: Reputation: 53
Are you using official packages? I've never seen that problem, PHP works fine along with mysql and Apache on both of my machines.

Edit, put a file in /var/www/htdocs/ with this content (call it somethine like test.php):
Code:
<?
phpinfo();
?>
That should display all php info and will tell you if MySQL support is included.
Go to it with: http://localhost/test.php

Last edited by gbonvehi; 06-01-2005 at 04:53 PM.
 
Old 06-01-2005, 05:39 PM   #10
Dr. Psy
Member
 
Registered: May 2005
Distribution: Slackware 10.1
Posts: 49

Original Poster
Rep: Reputation: 15
Yep. all original, official packages.

Well, guess what? I just downloaded and reinstalled the Slackware php package from slackware.com, and now it's working. The mysql module is now loading properly. But remember that PHP security update? I am wondering what will happen when I install that.

I wonder if that has anything to do with it breaking?

If not, then I am at a TOTAL lost of what happened.

This is an original Slackware 10.1 install. Full install. And things like Mysql and PHP have not been TOUCHED until now! So nothing has changed from the original install, as far as those packages go. And then I reinstall the same package from slackware.com, and all is working now! Bizarre!

Well, okay, here I go. I am going to try the security update and see if it still loads the mysql module after that. Wish me luck!
 
Old 06-01-2005, 05:52 PM   #11
Dr. Psy
Member
 
Registered: May 2005
Distribution: Slackware 10.1
Posts: 49

Original Poster
Rep: Reputation: 15
Ok, downlaoded and installed the 2 security patches for PHP, and it said that they were already installed (I thought I would have to reinstall them, since I reinstalled php)

So, like I said, I am at a total loss of what happened!

I have been working for 2 days straight on this, trying everything I could think of, with absolutely no luck at all.

I download and reinstall the very same package that was installed with Slack10.1, and voila, everythings working. ???? I dont know....

At least it's finally running though. Geez! I'll have to remember this one in the future! I never had to struggle with anything like this so hard ever! lol!
 
Old 06-01-2005, 06:18 PM   #12
Dr. Psy
Member
 
Registered: May 2005
Distribution: Slackware 10.1
Posts: 49

Original Poster
Rep: Reputation: 15
Quote:
I'm sure it's something simple (it always is!)
Uh..huh!
What'd I tell ya!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Guide for snort+mysql+acid at Debian Woody Tredo Debian 1 02-03-2005 09:30 AM
mysql snort acid HELP wylie1001 Linux - Software 0 01-01-2005 06:51 PM
ACID Snort Mysql problems netmon Linux - Software 1 11-10-2003 12:37 PM
Running snort, MySQL and Acid on the same Computer dpatkins Linux - Newbie 1 04-14-2003 09:57 PM
[ACID, MySQL, Snort and PHP] MrGreg Linux - Networking 3 06-10-2002 12:44 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware

All times are GMT -5. The time now is 11:32 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration