Snort mailing list archives
Re: Database output
From: Dirk Geschke <Dirk_Geschke () genua de>
Date: Thu, 11 Dec 2003 10:40:04 +0100
Hi Erwin,
I'm using a postgresql database to store the output of my snort sensors, but what happens if the database is temporarily unavailable (for instance, connecting fails due to a heavy load on network / database)? Does snort keep the queries for sending when database connectivity is restored? Or are these queries dropped? In my opinion, storing these queries temporarily is the safest solution, as we must certainly log data when a severe attack on our network takes place... And then chances are bigger that we can't connect to the database immediately. And does snort open a database connection for every query it sends? Or is there some sort of persistent connection (for example one that times out after 1 minute of inactivity, closing the connection then)... I'd like to use SSL connections to the database, using stunnel, but opening a connection for every query would have severe consequences for network and server.
this are a lot of questions... First: The database output plugin has a major problem if the database dies. Actually the Insert() will fail and there is no mechanism built in to react on this problem. The alerts are not stored temporarily, they were silently dropped by the database output plugin (maybe another plugin stores them but that is another story). If the database is available again, you have to reconnect. But since the ouput plugin ignores the error messages you can't try a reconnect. (This is only done on startup of snort). Finally: The database connection is opened once (on startup of snort or on a reconfigure, which is at least restarts snort). After this the connection is persistant as long as the database is available. Therefore it should be possible to connect via a stunnel or a ssh tunnel. But I strongly recommend to use a different network for reporting alerts to a central database server. Don't use the "official" lines you are sniffing. And with a seperate network encryption should not be necessary. (BTW: What are you concerned of? All data could be sniffed? But this is what snort already does, so if someone can sniff your line he will already see the same as snort... It would make sense if the sensors are connect via WAN to the central database but then I would suggest to use a local database and access them via ssh/ssl to check the content. This should be much less traffic and less dangerous if there is a problem with the network.) Best regards Dirk -- +-------------------------------------------------------------+ | Dr. Dirk Geschke | E-mail: geschke () genua de | | Gesellschaft fuer Netzwerk | Tel. : +49-(0)-89-991950-131 | | und Unix Administration mbH | Fax : +49-(0)-89-991950-999 | | 85551 Kirchheim / Germany | Domagkstrasse 7 | +-------------------------------------------------------------+ ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Database output Erwin Van de Velde (Dec 10)
- Re: Database output Dirk Geschke (Dec 11)
- Re: Database output Erwin Van de Velde (Dec 11)
- Re: Database output Dirk Geschke (Dec 11)
- Re: Database output Erwin Van de Velde (Dec 11)
- Re: Database output Erwin Van de Velde (Dec 11)
- Re: Database output Dirk Geschke (Dec 11)
- <Possible follow-ups>
- RE: Database output Hutchinson, Andrew (Dec 11)
- Re: Database output Erwin Van de Velde (Dec 11)