Snort mailing list archives
RE: ACID with multiple Sensors?
From: "Gould, Scott" <sgould () gogstats org>
Date: Mon, 27 Sep 2004 11:22:20 -0400
Bill, Configure your multiple sensors to all log to the same MYSL database, each with a different sensor ID or name. I have not done this without using barnyard. But, in my experience in the past I had to manually create the additional sensor entries in the sensor table in the MySQL db, for each of the additional sensors. Things may have changed a little, so someone may have something to add, as I am no longer using this method myself. But, it did work in the past with this type of layout. 7 snort sensors. Each running snort and barnyard. Each instance of barnyard configured with a unique snort id to reference in the db, sending alerts to a single MySQL DB. Scott Gould, MCP Senior Network & Systems Analyst Gynecologic Oncology Group Statistical & Data Center sgould () gogstats org 716-845-5702 -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Bill Warren Sent: Monday, September 27, 2004 9:25 AM To: Snort-users () lists sourceforge net Subject: [Snort-users] ACID with multiple Sensors? All, I just got ACID, PHP, MySQL installed on my Snort box. Then hit it hard with Nessus to make sure that it works and it does. When I was reading the results I saw that I could search multiple senors. So, my question is how do I make multiple Snort boxes talk to each other? Thanks, Bill -- ********************************** Bill Warren Optivel, Inc. E-mail: bwarren () optivel com Voice: 317.275.2305 Fax: 317.275.2301 Web: http://www.optivel.com ********************************** ------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement on who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement on who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- ACID with multiple Sensors? Bill Warren (Sep 27)
- Re: ACID with multiple Sensors? Sean Brown (Sep 27)
- <Possible follow-ups>
- RE: ACID with multiple Sensors? Gould, Scott (Sep 27)