[Snort-users] Have Snort on our master log server

Matt Kettler mkettler at ...4108...
Tue Dec 27 08:35:33 EST 2005


Jacob Friis Saxberg wrote:
> Since all of our servers are logging to one server, shouldn't we just
> have Snort on that server, instead of on all of them?

Erm, what does the logging have to do with any of this?

Snort doesn't parse logfiles, it monitors network traffic. Pick your sensor
locations based on what network traffic you want to monitor.




More information about the Snort-users mailing list