[Snort-users] Using snort on a per-instance basis....archive databases

Matthew K. Lee mattl at ...12405...
Fri Oct 29 08:58:02 EDT 2004


I think that quickest solution would be to create a database on your
home network to house any archival information.  Your primary database
would obviously be on the laptop.  In the acid_conf.php page, you could
set the archival database to the database server on your home network.
When you bring the laptop "home", you could move all of the alerts to
the waiting archive database.  To do this quickly, you could simply the
"Total alerts", and then from the action menu choose "Archive alert(s)
(move)", and then click the "entire query" button.

This will move the remote information over to the archive database
(which is on your home network).

Best of luck!

Matthew Lee
-----Original Message-----
From: Jason Humes [mailto:jhumes at ...11232...] 
Sent: Friday, October 29, 2004 8:31 AM
To: 'snort-users at lists.sourceforge.net'
Subject: [Snort-users] Using snort on a per-instance basis....archive

I would like to know if there is someway to backup and clean the
database after each use of snort...basically we've got it running on a
notebook and when a client calls with a problem we usually drop the
notebook on their network for a week or so...I'm currently just using
to manually delete all the alerts in between each customer, but this
long and I don't really want to have to loose the data.  I would love to
able to archive the database after each customer deployment and clean
database back to a pristine state.  Can this be done?  I've got webmin
installed on this box if that helps me out at all.  Thanks.  Could I
after archiving the database for customerX, pull that archive back up
run through acid for analysis?  Thanks.



This Newsletter Sponsored by: Macrovision 
For reliable Linux application installations, use the industry's leading
setup authoring tool, InstallShield X. Learn more and evaluate 
today. http://clk.atdmt.com/MSI/go/ins0030000001msi/direct/01/
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list