When snort logs to db, it takes resources away from inspecting
traffic. Missing packets.
--
Joel Esler
Sent from the road.
On Aug 21, 2007, at 10:33 AM, bleh <mailbox.size.limit@gmail.com> wrote:
Can you explain what you mean by Snort "has to stop being an IDS"?
If Snort is no longer an IDS when logging directly to a DB what is it?
> In order for Snort to do an insert, it has to stop being an IDS.
> Personally, I don't want my IDS to miss any packets, regardless of
the
> extremely short amount of time it takes to do a DB insert.
(Unless you
> have a very busy DB).
>
> Still would rather you use Barnyard and Unified.
>
> Joel
>
> Jason Haar wrote:
>> Joel Esler wrote:
>>> As a general recommendation for everyone on the list, Snort
should never be logging directly to the DB.
>>>
>>>
>> Can you tell me why that is? I mean, surely directly accessing a DB
>> doesn't introduce much latency/load *unless* it continually
generates
>> events?
>>
>> i.e. if a particular installation of snort only generates 1 event
per
>> minute, is there really any difference between snort->mysql and
>> snort->barnyard?
>>
>> I could understand it being a problem if snort is having to queue
up
>> events while INSERTs are going on, but if that are spaced many
seconds
>> apart...?
>>
>
> --
>
>
> --
> joel esler | security consultant | Sourcefire | pgp is public
---
----------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a
browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
