[Snort-users] Barnyard's explained

Dirk Geschke Dirk_Geschke at ...1344...
Wed Jul 21 04:54:01 EDT 2004


Hi Jason,

> Obviously it would be best to have Snort dump to disk (unified format), and
> to rsync that data at (say) ten-minute intervals to a SEPARATE box, which
> has barnyard to dump the data into a SQL DB. That way there's nothing by I/O
> and network traffic involved in generating the data - all the CPU is
> available for "pure" sniffing.

maybe you should take a look at FLoP: http://www.geschke-online.de/FLoP/
This project does something similar, all output is written to a unix socket
where another process reads this data and simply forwards it to a central
server running a further process which feeds the database.

The INSERTs on the central server are done via an unix domain socket and
not via TCP so it should be by far faster. (And at least you don't even
need a hard disk on your sensor...)

Best regards

Dirk





More information about the Snort-users mailing list