[Snort-users] sensor.sid changes (increasing) with new db

JJ Cummings cummingsj at ...11827...
Fri Jun 13 09:10:05 EDT 2008


So, the SID field in the sensor table is an auto-increment value... this 
is where you would have to modify it... but it is of course this way for 
a reason... and there are risks to consider if and / or when you modify 
this...

Do you have multiple sensors, if so.. .how will they get a unique sid 
etc etc etc....

Cheers,
JJC

chris ryan wrote:
> Hi,
>
> i'm running snort 2.7.0 (output modules database) along with postgres &
> base. For testing purposes, i often wiped the database with the base
> clean scripts (table structure remains untouched).
>
> Every time i start snort with an empty database, it creates a sensor in
> the sensor table. Although i have only one sensor, snort seems to
> remember that last sensor.sid from the "old" database, and creates a new
> one with value+1.
>
> Can i controll that behaviour? I'd like to have a persistent sensor.sid,
> as i use it in my own scripts.
>
> Thanks in advance,
> Chris.
>
>
> -------------------------------------------------------------------------
> Check out the new SourceForge.net Marketplace.
> It's the best place to buy or sell services for
> just about anything Open Source.
> http://sourceforge.net/services/buy/index.php
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>   




More information about the Snort-users mailing list