Found some bugs

It looks like I found some bugs. I installed the OSSIM from
the Debian
packages, and I was following the Spanish HOWTO
http://www.ossim.net/dokuwiki/doku.php?i
d=installation:debian_en_espanol

It has the sql statements for inserting the tables into the
ossim
database.

# zcat
/usr/share/doc/ossim-mysql/contrib/create_mysql.sql.gz 
/usr/share/doc/ossim-mysql/contrib/ossim_config.sql.gz 
/usr/share/doc/ossim-mysql/contrib/ossim_data.sql.gz 
/usr/share/doc/ossim-mysql/contrib/realsecure.sql.gz | 
mysql -u root ossim -p


There are some sql errors in the file create_mysql.sql.
There are some
lines that begin with more than two dashes '---'. In
addition, there
are duplicate sql statements that cause key violations
starting with the
following line and four or five other inserts into
bp_asset_member_type.

INSERT INTO bp_asset_member_type (type_name) VALUES
('host');

Once I corrected these lines, the sql statements loaded
properly for
the file create_mysql.sql. I attached the sql file to this
message.

Because of the errors in the file, the data from 
ossim_config.sql.gz
got loaded either. This may be due to errors that occur in
the
create_mysql.sql.gz file which were detailed above.

I know for a fact that ossim_data.sql.gz did not get loaded
because it
affected the sid map which I will detail below. 

The file realsecure.sql.gz does not exist either .

In the HOWTO, the create_sidmap.pl should be run as follows.
The script
connects to the database and does the inserts, so it doesn't
need to be
piped into mysql.

/usr/share/ossim/scripts/create_sidmap.pl /etc/snort/rules

HTH,

brian
-- 
Brian Lavender
http://www.brie.com/brian/


------------------------------------------------------------
-------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and
a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
Os-sim-support mailing list
Os-sim-supportlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/os-sim-s
upport

Thanks a lot for the info Brian, this is a serious bug
indeed.

I'm just replacing the .tar.gz at sourceforge with this new
one and  
we're going to release a revision to the debian packages
too.

Greetings,

Dominique

Am 14.08.2007 um 23:42 schrieb Brian Lavender:

> It looks like I found some bugs. I installed the OSSIM
from the Debian
> packages, and I was following the Spanish HOWTO
> http://www.os
sim.net/dokuwiki/doku.php? 
> id=installation:debian_en_espanol
>
> It has the sql statements for inserting the tables into
the ossim
> database.
>
> # zcat
/usr/share/doc/ossim-mysql/contrib/create_mysql.sql.gz 
> /usr/share/doc/ossim-mysql/contrib/ossim_config.sql.gz

> /usr/share/doc/ossim-mysql/contrib/ossim_data.sql.gz 
> /usr/share/doc/ossim-mysql/contrib/realsecure.sql.gz |

> mysql -u root ossim -p
>
>
> There are some sql errors in the file create_mysql.sql.
There are some
> lines that begin with more than two dashes '---'. In
addition, there
> are duplicate sql statements that cause key violations
starting  
> with the
> following line and four or five other inserts into  
> bp_asset_member_type.
>
> INSERT INTO bp_asset_member_type (type_name) VALUES
('host');
>
> Once I corrected these lines, the sql statements loaded
properly for
> the file create_mysql.sql. I attached the sql file to
this message.
>
> Because of the errors in the file, the data from 
ossim_config.sql.gz
> got loaded either. This may be due to errors that occur
in the
> create_mysql.sql.gz file which were detailed above.
>
> I know for a fact that ossim_data.sql.gz did not get
loaded because it
> affected the sid map which I will detail below.
>
> The file realsecure.sql.gz does not exist either .
>
> In the HOWTO, the create_sidmap.pl should be run as
follows. The  
> script
> connects to the database and does the inserts, so it
doesn't need  
> to be
> piped into mysql.
>
> /usr/share/ossim/scripts/create_sidmap.pl
/etc/snort/rules
>
> HTH,
>
> brian
> -- 
> Brian Lavender
> http://www.brie.com/brian/

> <create_mysql.sql.gz>
>
------------------------------------------------------------
---------- 
> ---
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems? 
Stop.
> Now Search log events and configuration files using
AJAX and a  
> browser.
> Download your FREE copy of Splunk now >>  http://get.splunk.com/ 
> _______________________________________________
> Os-sim-support mailing list
> Os-sim-supportlists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/os-sim-s
upport


------------------------------------------------------------
-------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and
a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
Os-sim-support mailing list
Os-sim-supportlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/os-sim-s
upport

Things already look much better with the data loaded into
the tables.

brian

On Wed, Aug 15, 2007 at 12:11:08AM +0200, Juan Manuel
Lorenzo  wrote:
> Fixed tar.gz at sf.net and debian packages updated,
thanks again
> 
> Juanma
> 
> On 8/14/07, Brian Lavender <brianbrie.com> wrote:
> >
> > It looks like I found some bugs. I installed the
OSSIM from the Debian
> > packages, and I was following the Spanish HOWTO
> > http://www.ossim.net/dokuwiki/doku.php?i
d=installation:debian_en_espanol
> >
> > It has the sql statements for inserting the tables
into the ossim
> > database.
> >
> > # zcat
/usr/share/doc/ossim-mysql/contrib/create_mysql.sql.gz 
> >
/usr/share/doc/ossim-mysql/contrib/ossim_config.sql.gz 
> >
/usr/share/doc/ossim-mysql/contrib/ossim_data.sql.gz 
> >
/usr/share/doc/ossim-mysql/contrib/realsecure.sql.gz | 
> > mysql -u root ossim -p
> >
> >
> > There are some sql errors in the file
create_mysql.sql. There are some
> > lines that begin with more than two dashes '---'.
In addition, there
> > are duplicate sql statements that cause key
violations starting with the
> > following line and four or five other inserts into
bp_asset_member_type.
> >
> > INSERT INTO bp_asset_member_type (type_name)
VALUES ('host');
> >
> > Once I corrected these lines, the sql statements
loaded properly for
> > the file create_mysql.sql. I attached the sql file
to this message.
> >
> > Because of the errors in the file, the data from 
ossim_config.sql.gz
> > got loaded either. This may be due to errors that
occur in the
> > create_mysql.sql.gz file which were detailed
above.
> >
> > I know for a fact that ossim_data.sql.gz did not
get loaded because it
> > affected the sid map which I will detail below.
> >
> > The file realsecure.sql.gz does not exist either
.
> >
> > In the HOWTO, the create_sidmap.pl should be run
as follows. The script
> > connects to the database and does the inserts, so
it doesn't need to be
> > piped into mysql.
> >
> > /usr/share/ossim/scripts/create_sidmap.pl
/etc/snort/rules
> >
> > HTH,
> >
> > brian
> > --
> > Brian Lavender
> > http://www.brie.com/brian/

> >
> >
------------------------------------------------------------
-------------
> > This SF.net email is sponsored by: Splunk Inc.
> > Still grepping through log files to find problems?
 Stop.
> > Now Search log events and configuration files
using AJAX and a browser.
> > Download your FREE copy of Splunk now >>  http://get.splunk.com/
> > _______________________________________________
> > Os-sim-support mailing list
> > Os-sim-supportlists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/os-sim-s
upport
> >
> >
> >

-- 
Brian Lavender
http://www.brie.com/brian/


------------------------------------------------------------
-------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and
a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
Os-sim-support mailing list
Os-sim-supportlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/os-sim-s
upport