snort and mysql connection at start troubles

[César Amaya]

César Amaya wrote:
> Kevin Kinsey wrote:
>> César Amaya wrote:
>>> Hi list
>>>
>>> I am installing SNORT 2.4.5 to log into a MySQL-5.1 database. snort 
>>> logs are being stored fine into the db, but whe the system start 
>>> snort fails because of this: snort[396]: FATAL ERROR: database: 
>>> mysql_error: Can't connect to local MySQL server through socket 
>>> '/tmp/mysql.sock' (2)
>>>
>>> this is the configuration line in the snort.conf file
>>>
>>> output database: log, mysql, user=snortids password=PswIdS 
>>> dbname=snort host=localhost
>>>
>>> when I changed the 'localhost' name to 127.0.0.1 I got the following 
>>> error
>>>
>>> snort[401]: FATAL ERROR: database: mysql_error: Can't connect to 
>>> MySQL server on '127.0.0.1' (61)
>>>
>>> All of this happens at start time. After system started I start 
>>> snort manually and connect to mysql just fine.
>>>
>>> It seems that snort start earlier than mysql. I want to start mysql 
>>> earlier than snort but I don´t know how.
>>>
>>> Can some body help me?
>>>
>>
>> I think you should take a look at rcorder(8).
>>
>> Kevin Kinsey
>>
> I got mysql-server to start before snort
>
> proxy# rcorder /etc/rc.d/* /usr/local/etc/rc.d/*
> /usr/local/etc/rc.d/apache22.sh
> /etc/rc.d/DAEMON
> /etc/rc.d/LOGIN
> /usr/local/etc/rc.d/mysql-server
> /usr/local/etc/rc.d/snort
> /etc/rc.d/ypxfrd
>
> even though, I still have the same problem
> snort[471]: FATAL ERROR: database: mysql_error: Can't connect to local 
> MySQL server through socket '/tmp/mysql.sock' (2)
>
> Any thought?
>
I found out where the problem is. Like I said before, the thing is that 
mysql must start prior to snort, but mysql have no enough time to 
completely start. So I told this to my boss and then he told me to put a 
delay into the snort start file, and I did so.
I added the command /sleep 60 /in the first line of the snort start file 
and it worked just fine.

best regards!