[Snort-users] multiple instances of snort

Kreimendahl, Chad J Chad.Kreimendahl at ...4716...
Tue Jan 28 12:00:05 EST 2003

The easiest solution would be to define a different sensor name in the
output config line of your snort.conf.   This will help to differentiate
the different instances.  If they're running on different interfaces,
the same sensor name can be used.

-----Original Message-----
From: Schroeder, Eric [mailto:Eric.Schroeder at ...6310...] 
Sent: Tuesday, January 28, 2003 1:12 PM
To: 'snort-users at lists.sourceforge.net'
Subject: [Snort-users] multiple instances of snort

I have multiple instances of Snort running on one machine and logging to
same MySQL database.  I get error messages like:

database: mysql_error: Duplicate entry '2-3869689' for key 1
SQL=INSERT INTO event (sid,cid,signature,timestamp) VALUES ('2',
'14', '2003-01-28 10:25:10-06')

Does Snort recover from this?  Or should I find a better way?

-Eric Schroeder
Senior Network Engineer
Thomson Legal & Regulatory
610 Opperman Drive
Eagan, MN 55123
Phone: 651.848.2868

This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list