Whether the database is on the same machine as the sniffing interface
or not, you always want to use the unified output plugin, and have
barnyard insert the data into the database, especially when
performance concern. .
-Seth
On Wed, Jul 16, 2008 at 4:30 PM, Stewart L <stewartl42@gmail.com> wrote:
So, I'm a little confused with output...
For performance (sniffing Gig networks) would I be better off using the
database output module and writing directly to the database? Or should I be
doing unified logging and importing that to the database with barnyard?
I'm guessing writing directly to the database would be faster for remote
sensors, but I've been wrong before. :)
Would the same apply if the database was on the same machine as the sniffing
interface?
FYI, I'm planning on having one central database server that will also have
at least one sniffing interface (possibly up to three) and 3-4 remote
network sensors. the Central box is Beefy (Four multi-core processors, 16GB
of Ram and 1.2TB of disk).
--
Stewart
--
You only lose what you cling to.
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great
prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
