[Snort-users] Possible SQL workaround?

Kevin.Brown at ...1022... Kevin.Brown at ...1022...
Wed Jan 24 11:22:07 EST 2001


A thought occured to me on trying to deal with the problem of snort
pausing when ACID accessed the db.  I don't know if it will work, but could
the snort boxen each log to their own local sql server and then through
replication of the individual databases into one single db that could then be
looked at by ACID?  Or have all the boxen log to one db and then replicate
that db and access it through ACID.  That way snort doesn't lose any time or
information waiting for sql to unlock the db from read-only.

My setup
snort 1.7 listening near edge router on standalone system.

MySQL 3.22.32 on remote server
ACID 0.95

Any thoughts on this?





More information about the Snort-users mailing list