mysql, base, and snort and a plea for tips in general

[John Baker <johnnyb () marlboro edu>]

Hello

I'm a new Network Administrator trying to get a grip on the snort setup 
that I inherited. It sends the output to a LAMP server with base and 
snortreport as the frontends. I noticed a little discussion about this 
over the last few days so I thought that I would ask for a little advice 
on my troubles. It seems to quickly become an unhelpful time sink.

The first big problem I have is the simple maintenance of the database. 
It seems to easily and quickly get out of hand and slow queries waaaaay 
down while using almost all of the CPU.

Are there any specific MYSQL indexes, joins, or maintenance scripts that 
are good for performance?

I noticed somebody say that this setup is just not a good idea. Others 
have noted that barnyard can help.

I understand how barnyard can help snort itself but how can it help the 
MYQL end? And what is a better setup that mysql/base?

And last, I could really use a good guide to interpreting the alerts 
themselves. It sucks up a lot of my time just figuring out whether 
something is important or not. Does anybody have any good suggestions 
for interpretation guides?

Thanks.
-- 
John Baker
Network Systems Administrator
Marlboro College
Phone: 451-7551 off campus; 551 on campus

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users