[Snort-users] Any good tool for generating nice reports off a years worth of snort syslog data?

Jason Haar Jason.Haar at ...294...
Wed Nov 26 20:05:07 EST 2003


This has come up before, but I'm specifically interested in running over
Gbytes of syslog files. I've tried a couple of perl-based scripts, but
I've had to kill them when they hit 800M RAM and were still growing...
Most suffer (understandably) from the fact that they read in the entire
file before producing the stats. I guess I'm looking for a program that
sort of reads in a days worth of data at a time instead of the entire
lot...

[I'd love to just use ACID - but I have a distributed IDS network with
separate MySQL servers - and I've never found out how to merge such
databases back into a single one to do a stats run on...]

Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1






More information about the Snort-users mailing list