I was absolutely certain that it was something that I did wrong, so I went back to the beginning, reinstalled all the requires, compiled snort from scratch, turned on every log file I could find, and built a rule to log every occurence of GET on port 80. I've tried both snort and snort-inline compiled with --enable-inline and --with-mysql. Running with this command line snort -Q -c /etc/snort/snort.conf -v (replace snort with snort_inline as you wish). I get lots of screen activity from the -v, but snort doesn't write anything to a mysql database. Neither does snort_inline 2.4.3-RC3, compiled with the same options. If anyone has a suggestion or would like me to try something, email me. Mike- -- If you're not confused, you're not trying hard enough. -- Please note - Due to the intense volume of spam, we have installed site-wide spam filters at catherders.com. If email from you bounces, try non-HTML, non-encoded, non-attachments, ------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642 _______________________________________________ Snort-users mailing list Snort-users@xxxxxxxxxxxxxxxxxxxxx Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users