Bill,
Configure your multiple sensors to all log to the same MYSL database,
each with a different sensor ID or name. I have not done this without
using barnyard. But, in my experience in the past I had to manually
create the additional sensor entries in the sensor table in the MySQL
db, for each of the additional sensors. Things may have changed a
little, so someone may have something to add, as I am no longer using
this method myself. But, it did work in the past with this type of
layout.
7 snort sensors. Each running snort and barnyard. Each instance of
barnyard configured with a unique snort id to reference in the db,
sending alerts to a single MySQL DB.
Scott Gould, MCP
Senior Network & Systems Analyst
Gynecologic Oncology Group
Statistical & Data Center
sgould@gogstats.org
716-845-5702
-----Original Message-----
From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Bill
Warren
Sent: Monday, September 27, 2004 9:25 AM
To: Snort-users@lists.sourceforge.net
Subject: [Snort-users] ACID with multiple Sensors?
All,
I just got ACID, PHP, MySQL installed on my Snort box. Then hit it hard
with Nessus to make sure that it works and it does. When I was reading
the results I saw that I could search multiple senors. So, my question
is how do I make multiple Snort boxes talk to each other?
Thanks,
Bill
--
**********************************
Bill Warren
Optivel, Inc.
E-mail: bwarren@optivel.com
Voice: 317.275.2305
Fax: 317.275.2301
Web: http://www.optivel.com
**********************************
-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list
