From: Gould, Scott (sgouldgogstats.org)
Date: Fri Sep 24 2004 - 02:32:24 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

My 1st thought would be to check your snort.conf file for the
appropriate output plug-in configuration. You need to tell snort to log
to your mysql db, via an output db plug-in line in your snort.conf
file..

The documentation at snort.org and the snort.conf file give examples of
database output logging.

This, is however a method that may not be able to keep up with high
bandwidth. You may want to consider a flow like this if you have high
bandwidth pipes your monitoring:

Snort logs to binary log file

Barnyard monitors binary log file, and does inserts into mysql db

Lots of information about barnyard can be found in the various setup
docs available at snort.org, and by searching the archives of this list.

My best advice, only being at this for a year or so myself, is to start
simple (which your doing:-)), get your current setup working, then look
to tune performance down the road.

Hope this helps.

Scott Gould, MCP

Senior Network & Systems Analyst

Gynecologic Oncology Group

Statistical & Data Center

sgouldgogstats.org

716-845-5702

________________________________

From: snort-users-adminlists.sourceforge.net
[mailto:snort-users-adminlists.sourceforge.net] On Behalf Of kinux
Sent: Friday, September 24, 2004 2:10 AM
To: snort-userslists.sourceforge.net
Subject: [Snort-users] An acid problem.

hi,

i installed snort, mysql, acid by ports on a freebsd box.

When i try to display Alert Listing: 15 Last Alerts, there is nothing
show on the
screen. as following. What's the problem?

      ACID
     Alert Listing: 15 Last Alerts Home
            Search | AG Maintenance

      [ Back ]

Added 0 alert(s) to the Alert cache
 Queried DB on : Fri September 24, 2004 10:22:20 Meta Criteria any
                  IP Criteria any
                  Layer 4 Criteria none
                  Payload Criteria any

Displaying 15 Last Alerts

Thanks.

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]