Snort mailing list archives

Real time alerting with multiple sensors


From: "Federico" <egopfe () hotmail com>
Date: Wed, 13 Feb 2002 10:07:39 +0100

I've this problem, and this doubt for resolving it...
witch is the best chioice to have a real time feedback in my scenario ?
plz tell me wich is the best choice

The Scenario

+ About 10 sensors in a routed  MAN.
+ need to log to PostgreSQL for an historical purpose.
+ need to have a realtime feedback.

naturally i want to concentrate logs in one servers, and no to keep them
distribuited.


Solutions for real time feedback:

1) snmp traps to central server, snmptrapd scripted to send alerts by e-mail
(anyone knows some program to attach to snmptrapd?)
2) syslogd-ng from all sensors to central server, incident.pl running by
crond every 5 second and alerting by e-mail.

witch is the best solution ?
anyone has other solutions and/or some programs that can help me ??

thanks in advance.

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: