Keeping the size of your snort database is rather simple within Aanval.
Visit the Snort Module manager within the console and select the
snort database auto-trimming feature along with the preferred # of
records to begin trimming at. Aanval will ensure the snort database
does not grow beyond this record limit by trimming out the oldest
events first.
As for deleting specific events from Aanval based on source,
destination, etc... Use the Event Browser or the Search query
language like:
"sip:192.168.1.5 delete:"
This deletes all events with a source ip address of 192.168.1.5
* Of course take a look at the in-console help for more advanced
methods, or help in fine tuning your deleting.
-- SNIP --
Hello All,
I'm curious as to how people are managing the mysql backend data that =
snort
reports. I've been mulling over adding syslog entries to the mix, but =
with
the amount of denies I see at the borders/firewalls, the database is =
going
to get unwieldy pretty fast. Not being a DBA but knowing enough to get
things up and running, is there any 'canned' scripts out there to help =
me
out? I'm thinking along the lines of possibly archiving daily/weekly, =
having
the dbase drop entries older than X, or something to that effect. =20
Thoughts/suggestions?
Thanks!
-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
