[Snort-users] Multiple Sensors to 1 DB Server
Kevin.M.Brown at ...1022...
Fri Oct 11 15:59:02 EDT 2002
It is possible, I have done it with Snort logging to a remote SQL db. That
is what the SID field is for (which sensor logged that packet). Just have
to make sure that mysql will allow each of the sensors to log into the same
database and have only the minimum of permissions needed to log (insert,
From: The infoSphere
Sent: 10/11/02 1:20 PM
Subject: [Snort-users] Multiple Sensors to 1 DB Server
I have done this on a smaller scale(1 sensor to 1 DB server) before but
not with a bunch of sensors (more that one (2+) sensors to one(1) DB
server), I was just wondering if anyone has setup multiple snort senors
to log to one central DB server running MySQL. Pretty much my question
is a few yes' or no's unless there may be an issue,
Does Snort along with MySQL handle this well,
and or are there any potential issues or pitfalls i should be aware of.
Can i just tell the senors to log the central DB server and all will be
I know how to do the configurations and i have worked out a solution
for when the connections to the central server may go down while taking
into account actions to be taken on both the DB server and the sensors
so that no information gets lost, which I hope to be able to release to
the community soon. I just need to know if this should work OK or not.
There should not be any issue with having the central DB hold info for
multiple sensors right? This goes for things like primary keys in the
DB and all that good stuff.
Thanks a million in advance for any help or advice,
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users