[Snort-users] sensor.sid changes (increasing) with new db

chris ryan chris.ryan at ...348...
Fri Jun 13 07:03:56 EDT 2008


Hi,

i'm running snort 2.7.0 (output modules database) along with postgres &
base. For testing purposes, i often wiped the database with the base
clean scripts (table structure remains untouched).

Every time i start snort with an empty database, it creates a sensor in
the sensor table. Although i have only one sensor, snort seems to
remember that last sensor.sid from the "old" database, and creates a new
one with value+1.

Can i controll that behaviour? I'd like to have a persistent sensor.sid,
as i use it in my own scripts.

Thanks in advance,
Chris.





More information about the Snort-users mailing list