[Snort-users] Can Snort send it logs a remote DB?
pauls at ...6838...
Tue Mar 29 12:06:10 EST 2005
--On Tuesday, March 29, 2005 02:23:00 PM -0500 Bill Warren
<bwarren at ...12173...> wrote:
> I have 2 snort boxes that are collecting data and I would like to have a
> 3rd box with running some MySQL to collect the data and then have BASE
> read the data.
> So, can this be done?
> If so, would somebody point me to a doc(s) on how
> to do this?
Don't know about docs, but it's really not that hard. You have to create
accounts in mysql for each sensor's host. For example, if sensor number
one is on host "foo", then you need to create an account in mysql for
sensor1 at ...13227... If sensor two's host is "faa", then you create an
account for sensor2 at ...13228... Make sure the sensors have sufficient
rights to the db (SELECT, INSERT and UPDATE) so they can add events to the
Then, on each sensor, you edit the "output database" line so that it
"points" to the db host.
E.g. output database: log, mysql, user=sensor1, password=password
dbname=snort host=foo.example.com sensor_name=sensor1
Make sure the sensor hosts can access the db host on port 3306 (no firewall
blocking that port from those hosts) and then just restart the sensors.
You could even run BASE on a fourth host and "point it" to the db to get
the data. It's all a matter of telling the software where to look to find
what it needs.
Paul Schmehl (pauls at ...6838...)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
More information about the Snort-users