[Snort-devel] Snort.org Blog: Snort's output methods

Joel Esler jesler at ...402...
Mon Jun 27 11:16:55 EDT 2011


Snort's output methods

Ever since the beginning of Snort, one of the main concerns was "how do I get data out of Snort".  Some of the options available have their advantages and disadvantages.

There's some that aren't used.
There's some that cause Snort to be slow.
There's some that we don't maintain and don't frequently test.
There's some that we want to get rid of.

One of those output methods is the "spo_database" module.  Or the module in Snort that directly inputs data from Snort into a mysql, postgres, or an Oracle database.  This logging method was written back in the late 90's by a college student (along with the db schema and the interface ACID) as a project for his thesis. 

It hasn't been very well maintained since then.  In fact, we don't test against it, and we don't recommend it for use.  It makes Snort, which is a high-speed data processor, have to stop doing what it's doing (being an IPS), and insert data into the database.  While Snort is inserting into the database, this stops inspection waiting for the database connection.

So we are going to remove it.

In order to provide the type of functionality we'd like to provide with Snort in the next few releases (more data for you!), we needed someone to take over the maintenance of the db schema that is shipped with Snort as well.   As a result of the discussion on the Snort-devel list, the team members over at the barnyard2 project have agreed to take over the maintenance of these schemas.

At this point I'd like to hear from the community as well.  So please leave comments. 

What output plugins do you use?
Will you be affected by this change (we hope a lot of you aren't using the spo_database method)?
What other output plugins do you think we can "show the door"?

Please leave comments at the above link.


Joel Esler
OpenSource Community Manager

More information about the Snort-devel mailing list