Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Re: [Snort-users] Barnyard's explained
From: Dirk Geschke (Dirk_Geschkegenua.de)
Date: Wed Jul 21 2004 - 06:52:39 CDT
> Obviously it would be best to have Snort dump to disk (unified format), and
> to rsync that data at (say) ten-minute intervals to a SEPARATE box, which
> has barnyard to dump the data into a SQL DB. That way there's nothing by I/O
> and network traffic involved in generating the data - all the CPU is
> available for "pure" sniffing.
maybe you should take a look at FLoP: http://www.geschke-online.de/FLoP/
This project does something similar, all output is written to a unix socket
where another process reads this data and simply forwards it to a central
server running a further process which feeds the database.
The INSERTs on the central server are done via an unix domain socket and
not via TCP so it should be by far faster. (And at least you don't even
need a hard disk on your sensor...)
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
Snort-users mailing list
Go to this URL to change user options or unsubscribe:
Snort-users list archive: