Snort mailing list archives
Installation - Snort/MySQL/Apache all on one box vs dedicated MySQL/Apache server
From: "Humes, David G." <David.Humes () jhuapl edu>
Date: Thu, 16 Aug 2007 16:00:25 -0400
I was wondering if anyone could discuss their experience and pros and cons of setting up Snort with everything all on the same box, as described in Patrick Harper's guides, vs using a separate server for the database and http server. On the surface, it would seem to make sense to offload the database and analysis functions to a dedicated system so the sensors are not burdened with running the database and http server. Plus analyst activity can place a load on the system when dealing with large numbers of events. But, then the database server becomes a single point of failure for the remote sensors. So, I would have to have some way to rapidly recover a failed database server such as running it from a VM that I could push to another machine, hot spare, etc. Are there significant performance gains to be realized by offloading the database, web server, and analyst activity to a dedicated server? Are there technical issues with making this work? Thanks. Dave Humes Johns Hopkins University Applied Physics Laboratory Telecommunications Group (ITC) david.humes () jhuapl edu 443-778-6651
------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Installation - Snort/MySQL/Apache all on one box vs dedicated MySQL/Apache server Humes, David G. (Aug 16)