[Snort-users] mysql, base, and snort and a plea for tips in general
johnnyb at ...14152...
Fri Jun 15 11:36:20 EDT 2007
I'm a new Network Administrator trying to get a grip on the snort setup
that I inherited. It sends the output to a LAMP server with base and
snortreport as the frontends. I noticed a little discussion about this
over the last few days so I thought that I would ask for a little advice
on my troubles. It seems to quickly become an unhelpful time sink.
The first big problem I have is the simple maintenance of the database.
It seems to easily and quickly get out of hand and slow queries waaaaay
down while using almost all of the CPU.
Are there any specific MYSQL indexes, joins, or maintenance scripts that
are good for performance?
I noticed somebody say that this setup is just not a good idea. Others
have noted that barnyard can help.
I understand how barnyard can help snort itself but how can it help the
MYQL end? And what is a better setup that mysql/base?
And last, I could really use a good guide to interpreting the alerts
themselves. It sucks up a lot of my time just figuring out whether
something is important or not. Does anybody have any good suggestions
for interpretation guides?
Network Systems Administrator
Phone: 451-7551 off campus; 551 on campus
More information about the Snort-users