[Snort-users] sensor.sid changes (increasing) with new db

chris ryan chris.ryan at ...348...
Mon Jun 16 04:27:07 EDT 2008


JJ Cummings schrieb:
> So, the SID field in the sensor table is an auto-increment value... this 
> is where you would have to modify it... but it is of course this way for 
> a reason... and there are risks to consider if and / or when you modify 
> this...

> Do you have multiple sensors, if so.. .how will they get a unique sid 
> etc etc etc....

Well, an auto-increment sid is an easy method to provide unique sids in
case of adding new sensors to an existing db. In my speacial case, i'm
adding the same sensor again and again, without dropping the database.
For just that case, i have trouble keeping my external scripts or
barnyard.conf up to date, so a persistant sid would be fine.
As we only have one sensor assigned to that database, that should not
cause any side effects. I'll have a look at this, thanks for your reply.


cheers,
Chris.







More information about the Snort-users mailing list