[Snort-users] Database Logging with redundency

Jed Pickel jed at ...153...
Tue Aug 29 16:42:12 EDT 2000


> On Tue, Aug 29, 2000 at 03:35:52PM -0400, Jed Pickel wrote:
> MySQL in this case.  Table structures should be okay to mess with
> as long as we don't delete anything, and the sensors can be done one
> at a time, but I don't want all my sensors to croak just because I bounce
> in a new db daemon. 
> 
> (eg, is the db logger code in snort smart enough to reconnect if the socket
> closes? )

No. Not yet. But getting smarter every day. ;) Consider this item to
be on the todo list.

I will need to do some tests to find the best way to handle this sort
of error. Probably if an attempt to reconnect fails then fallover to
some other type of backup logging mechanism (This is an idea Steve
Halligan actually wrote to me earlier today).

* Jed



More information about the Snort-users mailing list