Hello
I'm a new Network Administrator trying to get a grip on the snort setup
that I inherited. It sends the output to a LAMP server with base and
snortreport as the frontends. I noticed a little discussion about this
over the last few days so I thought that I would ask for a little advice
on my troubles. It seems to quickly become an unhelpful time sink.
The first big problem I have is the simple maintenance of the database.
It seems to easily and quickly get out of hand and slow queries waaaaay
down while using almost all of the CPU.
Are there any specific MYSQL indexes, joins, or maintenance scripts that
are good for performance?
I noticed somebody say that this setup is just not a good idea. Others
have noted that barnyard can help.
I understand how barnyard can help snort itself but how can it help the
MYQL end? And what is a better setup that mysql/base?
And last, I could really use a good guide to interpreting the alerts
themselves. It sucks up a lot of my time just figuring out whether
something is important or not. Does anybody have any good suggestions
for interpretation guides?
Thanks.
--
John Baker
Network Systems Administrator
Marlboro College
Phone: 451-7551 off campus; 551 on campus
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
