[Snort-users] what's the difference between alert_fast and alert_unified?

Matt Kettler mkettler at ...4108...
Fri Oct 21 08:42:38 EDT 2005


zhaohui yin wrote:
> Hi all:
>     I am confused the snort option about alert_fast /alert_unified,
> and want to known in which mode ,snort will run fastest.

unified is faster than alert_fast. "alert_fast" is a text-mode log for alerts,
and while it's fast for text mode, and much faster than alert_full, it's still a
text log.

However, alert_unified is a binary format and you need to use barnyard to
post-process the alerts into readable text. The unified binary format lets snort
dump the alerts to disk with an absolute minimum amount of overhead, as it
doesn't need to look up the alert descriptions, etc when logging.

>    I run snort with -b -A fast option, any suggestion?

By using -b you're already getting some speed benefit, as your packet log is
binary. Unified would extend this and make both your packet and your alert logs
binary.






More information about the Snort-users mailing list