[Snort-users] Barnyard2 and multiple sensors

Russell Fulton r.fulton at ...3809...
Thu Oct 21 01:47:49 EDT 2010

On 21/10/2010, at 5:18 PM, Joel Esler wrote:

> Run two instances of Barnyard as well.

Thanks Joel

That's what I figured but it means I need to have two sensor_ids and then have to amalgamate them back together in the front end, which is a bit of a pain.

> Joel
> On Oct 20, 2010, at 11:40 PM, Russell Fulton wrote:
>> Hi Folks
>> I am at the point where I need to have more than one snort instance running on a given sensor so we can take advantage of multiple CPUs and thus I will be producing multiple unified2 files on a sensor.  Logically there is still just one sensor -- can barnyard2 merge input from more than one input file?  I've googled and rtfm'ed and could not find anything that suggested that this is possible.  I hope I missed something :)
> --
> Joel Esler
> 302-223-5974

More information about the Snort-users mailing list