[Snort-users] Database Logging with redundency

Erik Fichtner emf at ...367...
Tue Aug 29 15:53:57 EDT 2000


On Tue, Aug 29, 2000 at 03:35:52PM -0400, Jed Pickel wrote:
> > Likewise, another thing I've been thinking about is how do I upgrade my 
> > database without having to touch a bunch of sensors?    
> 
> Hmm. I am not sure I understand this question. Do you mean upgrade
> MySQL, the table structure, or the code in the sensor that actually
> does the connection and logging to the database?

MySQL in this case.  Table structures should be okay to mess with
as long as we don't delete anything, and the sensors can be done one
at a time, but I don't want all my sensors to croak just because I bounce
in a new db daemon. 

(eg, is the db logger code in snort smart enough to reconnect if the socket
closes? )

(Yeah, yeah, I can just test it by killing my db, can't i.. )

-- 
Erik Fichtner
Security Administrator, ServerVault, Inc.



More information about the Snort-users mailing list