[Snort-users] ACID with multiple Sensors?

Sean Brown sblinux at ...9344...
Mon Sep 27 11:24:05 EDT 2004


On September 27, 2004 7:25 am, Bill Warren wrote:
> All,
>
> I just got ACID, PHP, MySQL installed on my Snort box.  Then hit it hard
> with Nessus to make sure that it works and it does.  When I was reading
> the results I saw that I could search multiple senors.  So, my question
> is how do I make multiple Snort boxes talk to each other?
>
> Thanks,
> Bill
I have snort running on a firewall, I configured 2 instances, on listening on 
the internal interface and one on the external, they use different .conf 
files so it would be the same as if they were on separate machines. Here is 
the mysql line from each:

External:
output database: log,mysql,dbname=snort user=snorter host=192.168.1.2 
port=3306 sensor_name=SPARTA_FW_EXT

Internal:
output database: log,mysql,dbname=snort user=snorter host=192.168.1.2 
port=3306 sensor_name=SPARTA_FW_INT

As you can see all you have to do is point them at the same database and 
assign each one a unique name, with the aptly named sensor_name.

-Sean Brown




More information about the Snort-users mailing list