[Snort-users] multiple instances of snort

Kreimendahl, Chad J Chad.Kreimendahl at ...4716...
Tue Jan 28 12:00:05 EST 2003


The easiest solution would be to define a different sensor name in the
output config line of your snort.conf.   This will help to differentiate
the different instances.  If they're running on different interfaces,
the same sensor name can be used.

-----Original Message-----
From: Schroeder, Eric [mailto:Eric.Schroeder at ...6310...] 
Sent: Tuesday, January 28, 2003 1:12 PM
To: 'snort-users at lists.sourceforge.net'
Subject: [Snort-users] multiple instances of snort


I have multiple instances of Snort running on one machine and logging to
the
same MySQL database.  I get error messages like:

database: mysql_error: Duplicate entry '2-3869689' for key 1
SQL=INSERT INTO event (sid,cid,signature,timestamp) VALUES ('2',
'3869689',
'14', '2003-01-28 10:25:10-06')

Does Snort recover from this?  Or should I find a better way?

-Eric Schroeder
=====================
Senior Network Engineer
Thomson Legal & Regulatory
610 Opperman Drive
Eagan, MN 55123
Phone: 651.848.2868
=====================
 


-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users




More information about the Snort-users mailing list