--On Tuesday, March 29, 2005 02:23:00 PM -0500 Bill Warren
<bwarren@optivel.com> wrote:
I have 2 snort boxes that are collecting data and I would like to have a
3rd box with running some MySQL to collect the data and then have BASE
read the data.
So, can this be done?
Of course.
If so, would somebody point me to a doc(s) on how
to do this?
Don't know about docs, but it's really not that hard. You have to create
accounts in mysql for each sensor's host. For example, if sensor number
one is on host "foo", then you need to create an account in mysql for
sensor1@foo.domain.tld. If sensor two's host is "faa", then you create an
account for sensor2@faa.domain.tld. Make sure the sensors have sufficient
rights to the db (SELECT, INSERT and UPDATE) so they can add events to the
db.
Then, on each sensor, you edit the "output database" line so that it
"points" to the db host.
E.g. output database: log, mysql, user=sensor1, password=password
dbname=snort host=foo.example.com sensor_name=sensor1
Make sure the sensor hosts can access the db host on port 3306 (no firewall
blocking that port from those hosts) and then just restart the sensors.
You could even run BASE on a fourth host and "point it" to the db to get
the data. It's all a matter of telling the software where to look to find
what it needs.
Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
