Snort mailing list archives
RE: BASE/AAnval MySQL dbase management
From: Administration <administration () remoteassessment com>
Date: Sat, 22 Apr 2006 20:58:58 -0700
Keeping the size of your snort database is rather simple within Aanval.Visit the Snort Module manager within the console and select the snort database auto-trimming feature along with the preferred # of records to begin trimming at. Aanval will ensure the snort database does not grow beyond this record limit by trimming out the oldest events first.
As for deleting specific events from Aanval based on source, destination, etc... Use the Event Browser or the Search query language like:
"sip:192.168.1.5 delete:" This deletes all events with a source ip address of 192.168.1.5* Of course take a look at the in-console help for more advanced methods, or help in fine tuning your deleting.
-- SNIP -- Hello All, I'm curious as to how people are managing the mysql backend data that = snort reports. I've been mulling over adding syslog entries to the mix, but = with the amount of denies I see at the borders/firewalls, the database is = going to get unwieldy pretty fast. Not being a DBA but knowing enough to get things up and running, is there any 'canned' scripts out there to help = me out? I'm thinking along the lines of possibly archiving daily/weekly, = having the dbase drop entries older than X, or something to that effect. =20 Thoughts/suggestions? Thanks! ------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- BASE/AAnval MySQL dbase management John Hally (Apr 20)
- Re: BASE/AAnval MySQL dbase management Paul Schmehl (Apr 22)
- <Possible follow-ups>
- RE: BASE/AAnval MySQL dbase management Irons, Clarence (Apr 20)
- RE: BASE/AAnval MySQL dbase management Administration (Apr 22)