[Snort-users] Can Snort send it logs a remote DB?

Paul Schmehl pauls at ...6838...
Tue Mar 29 12:06:10 EST 2005


--On Tuesday, March 29, 2005 02:23:00 PM -0500 Bill Warren 
<bwarren at ...12173...> wrote:

> I have 2 snort boxes that are collecting data and I would like to have a
> 3rd box with running some MySQL to collect the data and then have BASE
> read the data.
>
> So, can this be done?

Of course.

>  If so, would somebody point me to a doc(s) on how
> to do this?
>
Don't know about docs, but it's really not that hard.  You have to create 
accounts in mysql for each sensor's host.  For example, if sensor number 
one is on host "foo", then you need to create an account in mysql for 
sensor1 at ...13227...  If sensor two's host is "faa", then you create an 
account for sensor2 at ...13228...  Make sure the sensors have sufficient 
rights to the db (SELECT, INSERT and UPDATE) so they can add events to the 
db.

Then, on each sensor, you edit the "output database" line so that it 
"points" to the db host.

E.g. output database: log, mysql, user=sensor1, password=password 
dbname=snort host=foo.example.com sensor_name=sensor1

Make sure the sensor hosts can access the db host on port 3306 (no firewall 
blocking that port from those hosts) and then just restart the sensors.

You could even run BASE on a fourth host and "point it" to the db to get 
the data.  It's all a matter of telling the software where to look to find 
what it needs.

Paul Schmehl (pauls at ...6838...)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu




More information about the Snort-users mailing list