Re: Diagnosing MySQL server has gone away messages

[bleh <mailbox.size.limit () gmail com>]

Can you explain what you mean by Snort "has to stop being an IDS"? If Snort
is no longer an IDS when logging directly to a DB what is it?

> In order for Snort to do an insert, it has to stop being an IDS.
> Personally, I don't want my IDS to miss any packets, regardless of the
> extremely short amount of time it takes to do a DB insert.  (Unless you
> have a very busy DB).
>
> Still would rather you use Barnyard and Unified.
>
> Joel
>
> Jason Haar wrote:
> > Joel Esler wrote:
> > > As a general recommendation for everyone on the list, Snort should never
be logging directly to the DB.
> > >
> > Can you tell me why that is? I mean, surely directly accessing a DB
> > doesn't introduce much latency/load *unless* it continually generates
> > events?
> >
> > i.e. if a particular installation of snort only generates 1 event per
> > minute, is there really any difference between snort->mysql and
> > snort->barnyard?
> >
> > I could understand it being a problem if snort is having to queue up
> > events while INSERTs are going on, but if that are spaced many seconds
> > apart...?
>
> --
>
>
> --
> joel esler | security consultant | Sourcefire | pgp is public
 <http://www.geocrawler.com/redir-sf.php3?list=snort-users>

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users