[Snort-users] Re: ACID Configuration

Karl Lovink karl at ...500...
Sun Nov 12 02:45:29 EST 2000


I think the data will be lost. What should be implemented to get this fixed
is some kind of backlog. Snort should keep the data in a backlog and try to
resend the data t othe database server. When the database server is
available again it should empty his backlog.


Kind regards,
Karl


-----Oorspronkelijk bericht-----
Van: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net]Namens Frank Reid
Verzonden: zaterdag 11 november 2000 21:33
Aan: snort-users at lists.sourceforge.net
Onderwerp: RE: [Snort-users] Re: ACID Configuration


Thanks, Roman.  ACID is a very impressive project in its own right, and it
provides a great deal of functionality even now.  Thanks for supporting and
developing it.

Question on Snort... is behavior defined when logging to database and the
database becomes unavailable?  My specific concern is sensor behavior when
network anomalies prevent it from locating the database server, e.g. upon
loss of network connectivity for upstream reporting.  I could pull plugs and
guess at the results, but I figured someone would know based on the code
itself.  Thanks.

Frank


_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
http://lists.sourceforge.net/mailman/listinfo/snort-users




More information about the Snort-users mailing list