Brent,
You CAN, but most people do not, enable all of the signatures. An
easy start would be to take a look at the end of your snort.conf.
Each .rules file referenced is a group of signatures of the same type.
The default snort.conf has some entire rule sets disabled by default.
You are encouraged to look through the list and pick which sets would
be most appropriate for your environment. Enabling the
spyware-put.rules on a sensor that protects only web servers might not
be the best use of resources on an older box. In a situation like
that, just comment the spyware-put.rules line and enable all of the
rules files that you feel would be appropriate.
After you choose which entire sets you would like to have
enabled/disabled, then you can move on to disabled certain signatures
in the oinkmaster.conf.
-Seth
On Thu, Jul 10, 2008 at 8:00 AM, Brent Clark <brentgclarklist@gmail.com> wrote:
Hi List
I got the oinkmaster working and updating, but what interested me is
that the load average shot up just after i ran the update (specs of the
machine arnt great).
My question is, are we supposed to use ALL signatures offered, or what
method / practices is adopted or used.
Thank you in advance for you assistance in advance.
Regard
Brent Clark
-------------------------------------------------------------------------
Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
Studies have shown that voting for your favorite open source project,
along with a healthy diet, reduces your potential for chronic lameness
and boredom. Vote Now at http://www.sourceforge.net/community/cca08
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
Studies have shown that voting for your favorite open source project,
along with a healthy diet, reduces your potential for chronic lameness
and boredom. Vote Now at http://www.sourceforge.net/community/cca08
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
