[Snort-users] reboot the DB
erek at ...950...
Mon Jul 7 13:39:16 EDT 2003
On Mon, 7 Jul 2003, Bryan Irvine wrote:
> Out of curiosity, what would happen if I rebooted the database server?
> Would Snort just queue up the logs and dump them when it comes back
> online? I don't need to do this, it's more just philosophical in case I
> ever need to.
No. Snort would block and then all the alerts would go into the bit
What you really want is Barnyard. It was built to handle things just like
that. If the connectivity to the DB drops, the alerts spool and are sent
once the connections are restored.
"When things get weird, the weird turn pro." H.S. Thompson
More information about the Snort-users