[Snort-users] Possible SQL workaround?

Guillaume guillaume at ...1168...
Wed Jan 24 11:45:40 EST 2001

Kevin.Brown at ...1022... wrote:

> A thought occured to me on trying to deal with the problem of snort
> pausing when ACID accessed the db.  I don't know if it will work, but could
> the snort boxen each log to their own local sql server and then through
> replication of the individual databases into one single db that could then be
> looked at by ACID?  Or have all the boxen log to one db and then replicate
> that db and access it through ACID.  That way snort doesn't lose any time or
> information waiting for sql to unlock the db from read-only.

I tried something like logginf everything these last days. Except disk-space
consumption, the main problem was mysql hanging up while querying with ACID.

I am currently trying to make it work with the 3.23.32 version of mysql.
The main goal is to have master DB used to log in, and slaves DB to execute
select statements.
Will tell you as soon as it works !


More information about the Snort-users mailing list