Snort mailing list archives
Re: Can Snort send it logs a remote DB?
From: Paul Schmehl <pauls () utdallas edu>
Date: Tue, 29 Mar 2005 14:05:47 -0600
--On Tuesday, March 29, 2005 02:23:00 PM -0500 Bill Warren <bwarren () optivel com> wrote:
I have 2 snort boxes that are collecting data and I would like to have a 3rd box with running some MySQL to collect the data and then have BASE read the data. So, can this be done?
Of course.
Don't know about docs, but it's really not that hard. You have to create accounts in mysql for each sensor's host. For example, if sensor number one is on host "foo", then you need to create an account in mysql for sensor1 () foo domain tld. If sensor two's host is "faa", then you create an account for sensor2 () faa domain tld. Make sure the sensors have sufficient rights to the db (SELECT, INSERT and UPDATE) so they can add events to the db.If so, would somebody point me to a doc(s) on how to do this?
Then, on each sensor, you edit the "output database" line so that it "points" to the db host.
E.g. output database: log, mysql, user=sensor1, password=password dbname=snort host=foo.example.com sensor_name=sensor1
Make sure the sensor hosts can access the db host on port 3306 (no firewall blocking that port from those hosts) and then just restart the sensors.
You could even run BASE on a fourth host and "point it" to the db to get the data. It's all a matter of telling the software where to look to find what it needs.
Paul Schmehl (pauls () utdallas edu) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Can Snort send it logs a remote DB? Bill Warren (Mar 29)
- Re: Can Snort send it logs a remote DB? Paul Schmehl (Mar 29)