Could you look at this thread regarding the MySQL database output of Snort 2.8.X. It has a one-line patch in spo_database.c to reconnect to the automatically. I must manually make this change each time Snort is updated from ports. http://www.snort.org/archive-4-4983.html Thanks in advance. Frank