[Snort-users] mysql, base, and snort and a plea for tips in general

John Baker johnnyb at ...14152...
Fri Jun 15 11:36:20 EDT 2007


I'm a new Network Administrator trying to get a grip on the snort setup 
that I inherited. It sends the output to a LAMP server with base and 
snortreport as the frontends. I noticed a little discussion about this 
over the last few days so I thought that I would ask for a little advice 
on my troubles. It seems to quickly become an unhelpful time sink.

The first big problem I have is the simple maintenance of the database. 
It seems to easily and quickly get out of hand and slow queries waaaaay 
down while using almost all of the CPU.

Are there any specific MYSQL indexes, joins, or maintenance scripts that 
are good for performance?

I noticed somebody say that this setup is just not a good idea. Others 
have noted that barnyard can help.

I understand how barnyard can help snort itself but how can it help the 
MYQL end? And what is a better setup that mysql/base?

And last, I could really use a good guide to interpreting the alerts 
themselves. It sucks up a lot of my time just figuring out whether 
something is important or not. Does anybody have any good suggestions 
for interpretation guides?

John Baker
Network Systems Administrator
Marlboro College
Phone: 451-7551 off campus; 551 on campus

More information about the Snort-users mailing list