[Snort-users] Database connection "Established" or Not?

Erek Adams erek at ...950...
Tue Jan 28 13:52:08 EST 2003


On Tue, 28 Jan 2003, Chris N wrote:

> I notice that sometimes snort will dropped its connection between a remote
> sensor and the logging database.. At first I thought something was wrong, but
> then I noticed the connection sometimes reestablishes itself.. Snort remains
> running just the network connection is dropped, is this Normal?
>
> I created a restart script but I don't wont to use it if this is normal Snort
> behavior.

Yep, that's normal.

Suggestion:  Use Barnyard [0].    Note:  It's not at a "production" level,
but quite a few people use it in that respect.  You won't get quite as
much info as you do using the db output plugin, but it doesn't barf on
lack of connectivity!  :)

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


[0]	http://www.snort.org/dl/barnyard/




More information about the Snort-users mailing list