Re: [Snort-users] Diagnosing MySQL server has gone away messages

Joel Esler wrote:
> As a general recommendation for everyone on the list, Snort should never be 
> logging directly to the DB.
>
>   
Can you tell me why that is? I mean, surely directly accessing a DB
doesn't introduce much latency/load *unless* it continually generates
events?

i.e. if a particular installation of snort only generates 1 event per
minute, is there really any difference between snort->mysql and
snort->barnyard?

I could understand it being a problem if snort is having to queue up
events while INSERTs are going on, but if that are spaced many seconds
apart...?

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users