[Snort-users] Drifting timestamps

Jacob Roberts jake_roberts at ...10077...
Fri Oct 15 15:54:32 EDT 2004


We have a snort setup with barnyard which dumps in to a MySQL database.
We stop snort and barnyard each day, delete the database, re-create it,
then restart snort and barnyard.

As snort runs through the day we start to see the timestamps of alerts
drift behind actual time.  We aren't receiving an excessive amount of
alerts so we ruled out Barnyard not being able to keep up with the
alerts generated by Snort (I don't know if that would happen anyways)

Has anyone had anything like this happen?  We haven't been able to track
it down and aren't sure what to do.

Thanks,
Jake Roberts
Brigham Young University
jake_roberts at ...10077...




More information about the Snort-users mailing list