Hi,

First off thanks for these great tools. I'm just starting with them but they look great. I'm not even remotely an SQL head so I slowly went through the whole MySQL setup and created the first database without issues. The help file says to use the contents of the 'schema' file for the events database which I presumed was fw.v106.sql . I doesn't create the Schema table entry. I won't even pretend to know what it does but I compared that file to the hsc.v104.sql that had worked earlier and found that the ` marks where missing from around the 2 Schema arguments, adding them seems to have done the trick.

--Schema version
CREATE TABLE `schema` (
  vseq        INT         UNSIGNED NOT NULL,
  ctime       DATETIME    NOT NULL,
  stype       VARCHAR(10) NOT NULL,
  PRIMARY KEY (vseq)
);
INSERT INTO `schema` (vseq, ctime, stype) VALUES ('106', now(), 'fw');

Hi Jeff,

Apologies for not responding here sooner. I replied to the auto-mail last month but didnt notice until this morning that it had bounced. I used the winsnort guide to setup the sensor and during the process it has you setup what I eventually realized were the same event databases. I just pointed the control center to their database instead of FWevents so I never got a chance to test it. I'm hoping to setup another winsnort box in the next few weeks and will give it a go then.

Thanks again for the great tools. The more I use the Policy manager and Console the more I realize I'd be screwed without them. If we ever get to the budget/equipment level where a central co-ordinator suite is needed I'll definitely be looking at your full products.

Cheers,

Derek.