Snort mailing list archives
RE: Anyone using "Enterprise implementation"?
From: "Hutchinson, Andrew" <andrew.hutchinson () Vanderbilt Edu>
Date: Tue, 26 Aug 2003 09:11:16 -0500
If you are writing that much information to the db every 8 hours, I think that what you may want to look at is tuning the ruleset rather than tuning the manegement/viewing console. Most of the information that is being logged is likely not classifiable as "EOI" (Event Of Interest). I would tune your ruleset to eliminate the chaff before trying to tune the database or the frontend. Andrew Andrew Hutchinson - Network Security Vanderbilt University Medical Center (615) 936-2856
-----Original Message----- From: Emre Bastuz [mailto:info () emre de] Sent: Tuesday, August 26, 2003 4:04 AM To: snort-users () lists sourceforge net Subject: [Snort-users] Anyone using "Enterprise implementation"? Hi, I´ve been planning to deploy Acid+Snort+Snortcenter in an "enterprise" scenario with about 10 sensors with GigE Interfaces and one managment machine with mysql,apache, etc.. During my initial test Snort wrote about 6 Gig of information from sensor to managment machine within 8 hours. Not that I did not expect this but the mysql queries on the Acid console take forever thus leaving the system completely useless. I read the FAQ and also did some serious Googling to learn how to improve performance but creating indexes and tuning buffers did not really help. Is anyone out there using Acid+Snort+Snortcenter in an environment like I´m planning to do? How do you guys handle the huge data that is being written to the db? Just wondering: just one sensor with GigE, sniffing on 3x100mbit is generating that much data, how does Acid+Snort scale when using with more sensors? I could live with doing daily archives of the database but I´m afraid with multiple sensorts I would have to switch to archiving every 12 or 6 hours. Any solution or suggestion? Even links, faq´s and docs I might have missed are very welcome :) Emre -- info () emre de http://www.emre.de UIN: 561260 PGP Key ID: 0xAFAC77FD I don't see why some people even HAVE cars. -- Calvin ------------------------------------------------------- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Anyone using "Enterprise implementation"? Emre Bastuz (Aug 26)
- RE: Anyone using "Enterprise implementation"? Jeff Dell (Aug 26)
- RE: Anyone using "Enterprise implementation"? Tom Van Overbeke (Aug 26)
- Re: Anyone using "Enterprise implementation"? Jason Haar (Aug 26)
- Re: Anyone using "Enterprise implementation"? Herve Debar (Aug 27)
- Re: Anyone using "Enterprise implementation"? Emre Bastuz (Aug 27)
- Re: Anyone using "Enterprise implementation"? Nagesh Chavan (Aug 28)
- <Possible follow-ups>
- RE: Anyone using "Enterprise implementation"? Hutchinson, Andrew (Aug 26)
- RE: Anyone using "Enterprise implementation"? Kreimendahl, Chad J (Aug 26)
- RE: Anyone using "Enterprise implementation"? Michael Steele (Aug 26)
- Re: Anyone using "Enterprise implementation"? cc (Aug 26)
- Re: Anyone using "Enterprise implementation"? Rich Adamson (Aug 27)
- RE: Anyone using "Enterprise implementation"? Tom Van Overbeke (Aug 27)
- Re: Anyone using "Enterprise implementation"? Jason Haar (Aug 31)