I was wondering if anyone could discuss their experience and pros and
cons of setting up Snort with everything all on the same box, as
described in Patrick Harper's guides, vs using a separate server for the
database and http server. On the surface, it would seem to make sense
to offload the database and analysis functions to a dedicated system so
the sensors are not burdened with running the database and http server.
Plus analyst activity can place a load on the system when dealing with
large numbers of events. But, then the database server becomes a single
point of failure for the remote sensors. So, I would have to have some
way to rapidly recover a failed database server such as running it from
a VM that I could push to another machine, hot spare, etc. Are there
significant performance gains to be realized by offloading the database,
web server, and analyst activity to a dedicated server? Are there
technical issues with making this work?
Thanks.
Dave Humes
Johns Hopkins University Applied Physics Laboratory
Telecommunications Group (ITC)
david.humes@jhuapl.edu
443-778-6651
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
