[Snort-users] mysql database "gone away"

Jason Brvenik jasonb at ...1935...
Mon Jul 16 20:45:57 EDT 2007


> 
> Obviously it would be nice if some process could be configured to retry
> this connection and get the data back to the server.  What do other
> people use to get over this problem ?  I mean, if you have a
> connectivity problem into your data centre and you lose connectivty to
> all your probes, do people really manually log into each remote probe
> and restart the service ?  It just seems a bit . . . manual.  I accept
> that it is a limitation of the mysql client in use, but in practical
> terms what do people do to ensure the database link doesn't stay down
> for hours(days/weeks) after a temporary glitch like this ?
> 

Use unified output and barnyard. Writing to the database directly from
the snort engine directly should be a last resort.




More information about the Snort-users mailing list