[Snort-users] mysql database "gone away"
jasonb at ...1935...
Mon Jul 16 20:45:57 EDT 2007
> Obviously it would be nice if some process could be configured to retry
> this connection and get the data back to the server. What do other
> people use to get over this problem ? I mean, if you have a
> connectivity problem into your data centre and you lose connectivty to
> all your probes, do people really manually log into each remote probe
> and restart the service ? It just seems a bit . . . manual. I accept
> that it is a limitation of the mysql client in use, but in practical
> terms what do people do to ensure the database link doesn't stay down
> for hours(days/weeks) after a temporary glitch like this ?
Use unified output and barnyard. Writing to the database directly from
the snort engine directly should be a last resort.
More information about the Snort-users