The following Frequently Asked Questions, answered by the authors of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to http://www.syngress.com/solutions and click on the "Ask the Author" form.

Q: What database permissions are needed for proper BASE functioning?

A: Snort needs only Insert and Select privileges to log on to a database. BASE needs Select privileges for running queries, Insert and Update for alert group support and caching, and Delete for alert deletion.

Q: How can I add support for portscan file processing by BASE?

A: Al It is a little tricky. When logging to a database. Snort only logs an occurrence of the portscan event and not all of the port's data. It is possible to force BASE to process a text portscaMogply one file can be configured). The file to be processed is configured in the $sportscan _file variable. BASE does not store retrieved information in a database, but proceses this file on demand, so it is not possible to search by IPs occuring in a portscan file.

Q: When I start my Swatch script in the background And, it stops soon afterward. What's wrong?

A: You possibly have echo actions used in a configuration file. Background processes are not allowed to communicate with the console,so when...