Unified output w/ barnyard in both cases.
Database direct input should be avoided at all costs.
J
On Jul 16, 2008, at 4:30 PM, Stewart L wrote:
So, I'm a little confused with output...
For performance (sniffing Gig networks) would I be better off using
the database output module and writing directly to the database? Or
should I be doing unified logging and importing that to the database
with barnyard?
I'm guessing writing directly to the database would be faster for
remote sensors, but I've been wrong before. :)
Would the same apply if the database was on the same machine as the
sniffing interface?
FYI, I'm planning on having one central database server that will
also have at least one sniffing interface (possibly up to three) and
3-4 remote network sensors. the Central box is Beefy (Four multi-
core processors, 16GB of Ram and 1.2TB of disk).
--
Stewart
--
You only lose what you cling to.
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's
challenge
Build the coolest Linux based applications with Moblin SDK & win
great prizes
Grand prize is a trip for two to an Open Source event anywhere in
the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
