Re: mysql/snort backup issue

[Erek Adams <erek () snort org>]

On Wed, 24 Sep 2003, John Byrnes wrote:

[...snip...]

> After I do this, I have to restart all of my sensors to get them to
> resume inserting events in the db. (This is my problem) I'm assuming
> this is because the mysqldump script must lock the db for inserts, and
> snort must stop trying if the db is unavailable, and doesn't retry. I
> could be completely wrong.

Normal behavior.  If Snort can't connect to the DB, then you loose alerts.
Instead, use BarnYard and it will automagically spool alerts until the DB
comes back.

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users